diff options
| author | Vitor Sessak <vitor1001@gmail.com> | 2010-02-26 18:12:27 +0000 |
|---|---|---|
| committer | Vitor Sessak <vitor1001@gmail.com> | 2010-02-26 18:12:27 +0000 |
| commit | 4784b0922febe020c31e0fc6b37dd8b4d86b28f0 (patch) | |
| tree | 3c42d81d26415f2c86ced34b23d02f1c27477c37 | |
| parent | 50ff78db019bb4ac77d546c53bd785def81394f8 (diff) | |
| download | ffmpeg-4784b0922febe020c31e0fc6b37dd8b4d86b28f0.tar.gz | |
Do not read beyond end of input in EA-TGV. This should avoid FATE test #362
result depending on uninitialized data.
FATE result may change for this test.
Originally committed as revision 22082 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/eatgv.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c index bfaf2d4158..5eb31b7fc8 100644 --- a/libavcodec/eatgv.c +++ b/libavcodec/eatgv.c @@ -192,6 +192,10 @@ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *b s->block_codebook[i][15-j] = tmp[get_bits(&gb, 2)]; } + if (get_bits_left(&gb) < vector_bits * + (s->avctx->height/4) * (s->avctx->width/4)) + return -1; + /* read vectors and build frame */ for(y=0; y<s->avctx->height/4; y++) for(x=0; x<s->avctx->width/4; x++) { |