diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-07-11 00:05:40 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-07-11 00:22:29 +0200 |
| commit | c06e556274446a45efab34745c05049033389260 (patch) | |
| tree | 6506853f5e069cc7ba6cb8b5cd4a5bc70e652aeb | |
| parent | 75fd5ce4c1c0b2d96d71c74b650cefaaef519d27 (diff) | |
| download | ffmpeg-c06e556274446a45efab34745c05049033389260.tar.gz | |
avcodec/mpeg4videodec: Check P cbpy
Fixes undefined behavior
Fixes: signal_sigsegv_c3097a_991_xtrem_e2_m64q15_a32sxx.3gp
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/mpeg4videodec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index cb2a5024b3..2234e3718a 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -1354,6 +1354,11 @@ static int mpeg4_decode_mb(MpegEncContext *s, int16_t block[6][64]) else s->mcsel = 0; cbpy = get_vlc2(&s->gb, ff_h263_cbpy_vlc.table, CBPY_VLC_BITS, 1) ^ 0x0F; + if (cbpy < 0) { + av_log(s->avctx, AV_LOG_ERROR, + "P cbpy damaged at %d %d\n", s->mb_x, s->mb_y); + return AVERROR_INVALIDDATA; + } cbp = (cbpc & 3) | (cbpy << 2); if (dquant) |