diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-05-14 01:01:35 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-05-21 20:43:38 +0200 |
| commit | cdc4727766f88e518f3914f90d66175079cd659b (patch) | |
| tree | f1493c731f09b77274d5779231fa1f9ccd3eb178 | |
| parent | 4858ee1d9c1fda4257930fccde8a7c229d3ef790 (diff) | |
| download | ffmpeg-cdc4727766f88e518f3914f90d66175079cd659b.tar.gz | |
avcodec/on2avc: Check run more carefully
Fixes CID1239106
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 22f15f5735389e992ec9aed43b0680e75746b3a1)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/on2avc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/on2avc.c b/libavcodec/on2avc.c index 01977e5bbc..7d2e81a57f 100644 --- a/libavcodec/on2avc.c +++ b/libavcodec/on2avc.c @@ -119,12 +119,12 @@ static int on2avc_decode_band_types(On2AVCContext *c, GetBitContext *gb) run_len = 1; do { run = get_bits(gb, bits_per_sect); + if (run > num_bands - band - run_len) { + av_log(c->avctx, AV_LOG_ERROR, "Invalid band type run\n"); + return AVERROR_INVALIDDATA; + } run_len += run; } while (run == esc_val); - if (band + run_len > num_bands) { - av_log(c->avctx, AV_LOG_ERROR, "Invalid band type run\n"); - return AVERROR_INVALIDDATA; - } for (i = band; i < band + run_len; i++) { c->band_type[i] = band_type; c->band_run_end[i] = band + run_len; |