aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-02-14 11:50:57 -0800
committerRonald S. Bultje <rsbultje@gmail.com>2012-02-16 08:36:08 -0800
commitc6643fddba73560f26f90d327c84d8832222a720 (patch)
tree09f7a58cde29e7943d4baa199f2b57ceee7efb41
parentc9fdf3241a96f01496facea9249b3965fa2df653 (diff)
downloadffmpeg-c6643fddba73560f26f90d327c84d8832222a720.tar.gz
golomb: avoid infinite loop on all-zero input (or end of buffer).
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
-rw-r--r--libavcodec/golomb.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
index 503aa1416a..e19064c642 100644
--- a/libavcodec/golomb.h
+++ b/libavcodec/golomb.h
@@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
}else{
int ret = 1;
- while (1) {
+ do {
buf >>= 32 - 8;
LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8));
@@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf];
UPDATE_CACHE(re, gb);
buf = GET_CACHE(re, gb);
- }
+ } while (ret);
CLOSE_READER(re, gb);
return ret - 1;