diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-03-09 00:44:49 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-09 00:44:49 +0100 |
| commit | bb2a5ea2cf10125ebabc9026ba63536a210c957f (patch) | |
| tree | a9f35cfde843d790791e609b30ade4742e34cfcf | |
| parent | 1f44b09d58d96ae98e91755cd3db2689e1deaf15 (diff) | |
| parent | 2c63081b48d98f3a0d0bed7b0ec3c0347b99144c (diff) | |
| download | ffmpeg-bb2a5ea2cf10125ebabc9026ba63536a210c957f.tar.gz | |
Merge commit '2c63081b48d98f3a0d0bed7b0ec3c0347b99144c' into release/2.4
* commit '2c63081b48d98f3a0d0bed7b0ec3c0347b99144c':
mdec: check for out of bounds read
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/mdec.c | 20 |
1 files changed, 13 insertions, 7 deletions
diff --git a/libavcodec/mdec.c b/libavcodec/mdec.c index 051adaefe2..5fd06f4aa6 100644 --- a/libavcodec/mdec.c +++ b/libavcodec/mdec.c @@ -88,7 +88,12 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n) if (level == 127) { break; } else if (level != 0) { - i += run; + i += run; + if (i > 63) { + av_log(a->avctx, AV_LOG_ERROR, + "ac-tex damaged at %d %d\n", a->mb_x, a->mb_y); + return AVERROR_INVALIDDATA; + } j = scantable[i]; level = (level * qscale * quant_matrix[j]) >> 3; level = (level ^ SHOW_SBITS(re, &a->gb, 1)) - SHOW_SBITS(re, &a->gb, 1); @@ -98,8 +103,13 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n) run = SHOW_UBITS(re, &a->gb, 6)+1; LAST_SKIP_BITS(re, &a->gb, 6); UPDATE_CACHE(re, &a->gb); level = SHOW_SBITS(re, &a->gb, 10); SKIP_BITS(re, &a->gb, 10); - i += run; - j = scantable[i]; + i += run; + if (i > 63) { + av_log(a->avctx, AV_LOG_ERROR, + "ac-tex damaged at %d %d\n", a->mb_x, a->mb_y); + return AVERROR_INVALIDDATA; + } + j = scantable[i]; if (level < 0) { level = -level; level = (level * qscale * quant_matrix[j]) >> 3; @@ -110,10 +120,6 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n) level = (level - 1) | 1; } } - if (i > 63) { - av_log(a->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", a->mb_x, a->mb_y); - return AVERROR_INVALIDDATA; - } block[j] = level; } |