diff options
| author | Thierry Foucu <tfoucu@gmail.com> | 2011-11-17 09:39:52 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-12-24 15:47:57 +0100 |
| commit | 94aacaf5083313378c6105bd71db04ce8f62c058 (patch) | |
| tree | 8deb817ec2c4c2e5acf4861d3acc91b744a30935 | |
| parent | 8d68083298e2481669de4db0b7b86c915119df6d (diff) | |
| download | ffmpeg-94aacaf5083313378c6105bd71db04ce8f62c058.tar.gz | |
vp6: Fix illegal read.
Found with Address Sanitizer
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit e0966eb140b3569b3d6b5b5008961944ef229c06)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit ba4b08b78918f399f9c9524750b26e904d146078)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/vp6.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavcodec/vp6.c b/libavcodec/vp6.c index 87834cd5c4..1fe24cf28c 100644 --- a/libavcodec/vp6.c +++ b/libavcodec/vp6.c @@ -439,7 +439,8 @@ static void vp6_parse_coeff(VP56Context *s) model1 = model->coeff_dccv[pt]; model2 = model->coeff_dcct[pt][ctx]; - for (coeff_idx=0; coeff_idx<64; ) { + coeff_idx = 0; + for (;;) { if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) { /* parse a coeff */ if (vp56_rac_get_prob(c, model2[2])) { @@ -480,8 +481,10 @@ static void vp6_parse_coeff(VP56Context *s) run += vp56_rac_get_prob(c, model3[i+8]) << i; } } - - cg = vp6_coeff_groups[coeff_idx+=run]; + coeff_idx += run; + if (coeff_idx >= 64) + break; + cg = vp6_coeff_groups[coeff_idx]; model1 = model2 = model->coeff_ract[pt][ct][cg]; } |