aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-01-29 18:29:41 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-03-20 22:02:28 +0100
commit562aa82d2a22cba39caede1d7b1243fdb6311ce5 (patch)
treecb02f3fd7e943ba5209ffcdcf0ebcb81abc84f18
parent3fb1a6c7025312ae745e0e9970a72c37a77c7a40 (diff)
downloadffmpeg-562aa82d2a22cba39caede1d7b1243fdb6311ce5.tar.gz
huffyuvdec: Check init_vlc() return codes.
Prevents out of array writes Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit f67a0d115254461649470452058fa3c28c0df294) Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 95ab8d33e1a680f30a5a9605175112008ab81afc) Conflicts: libavcodec/huffyuv.c
-rw-r--r--libavcodec/huffyuv.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
index cb7929b9a9..80203eccb1 100644
--- a/libavcodec/huffyuv.c
+++ b/libavcodec/huffyuv.c
@@ -320,6 +320,7 @@ static void generate_joint_tables(HYuvContext *s){
int len1 = s->len[p][u];
if(len1 > limit)
continue;
+ av_assert0(i < (1 << VLC_BITS));
len[i] = len0 + len1;
bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
symbols[i] = (y<<8) + u;
@@ -353,6 +354,7 @@ static void generate_joint_tables(HYuvContext *s){
int len2 = s->len[2][r&255];
if(len2 > limit1)
continue;
+ av_assert0(i < (1 << VLC_BITS));
len[i] = len0 + len1 + len2;
bits[i] = (code << len2) + s->bits[2][r&255];
if(s->decorrelate){
@@ -376,6 +378,7 @@ static void generate_joint_tables(HYuvContext *s){
static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
GetBitContext gb;
int i;
+ int ret;
init_get_bits(&gb, src, length*8);
@@ -386,7 +389,8 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
return -1;
}
ff_free_vlc(&s->vlc[i]);
- init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
+ if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
+ return ret;
}
generate_joint_tables(s);
@@ -397,6 +401,7 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
static int read_old_huffman_tables(HYuvContext *s){
GetBitContext gb;
int i;
+ int ret;
init_get_bits(&gb, classic_shift_luma, classic_shift_luma_table_size*8);
if(read_len_table(s->len[0], &gb)<0)
@@ -417,7 +422,8 @@ static int read_old_huffman_tables(HYuvContext *s){
for(i=0; i<3; i++){
ff_free_vlc(&s->vlc[i]);
- init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
+ if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
+ return ret;
}
generate_joint_tables(s);