diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-14 11:50:57 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-01 18:33:26 +0200 |
| commit | 3b5e1494c6e4bee4a0823b02d1342185252461d6 (patch) | |
| tree | 3d257b9795d89051e059ec150afd871f25b5014e | |
| parent | ccd528cc32024195c0ae1e5420223bff6ffc5317 (diff) | |
| download | ffmpeg-3b5e1494c6e4bee4a0823b02d1342185252461d6.tar.gz | |
golomb: avoid infinite loop on all-zero input (or end of buffer).
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c6643fddba73560f26f90d327c84d8832222a720)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/golomb.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h index 503aa1416a..e19064c642 100644 --- a/libavcodec/golomb.h +++ b/libavcodec/golomb.h @@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ }else{ int ret = 1; - while (1) { + do { buf >>= 32 - 8; LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8)); @@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf]; UPDATE_CACHE(re, gb); buf = GET_CACHE(re, gb); - } + } while (ret); CLOSE_READER(re, gb); return ret - 1; |