diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-02-14 12:40:36 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2013-02-23 09:22:30 +0100 |
| commit | ddfe1246d98f70cdce368a2176196ba26ed7bf2d (patch) | |
| tree | ca45eb83c54e28a254e8d7db61538221c02075de | |
| parent | 067432c1c95882c7221e694f33d9f3bdbe46de7f (diff) | |
| download | ffmpeg-ddfe1246d98f70cdce368a2176196ba26ed7bf2d.tar.gz | |
flicvideo: avoid an infinite loop in byte run compression
When byte_run is 0, pixel_countdown is not touched and the loop will run
forever.
CC:libav-stable@libav.org
| -rw-r--r-- | libavcodec/flicvideo.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index f0b5d50d02..08c3ef32a8 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -348,6 +348,11 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, pixel_countdown = s->avctx->width; while (pixel_countdown > 0) { byte_run = sign_extend(bytestream2_get_byte(&g2), 8); + if (!byte_run) { + av_log(avctx, AV_LOG_ERROR, "Invalid byte run value.\n"); + return AVERROR_INVALIDDATA; + } + if (byte_run > 0) { palette_idx1 = bytestream2_get_byte(&g2); CHECK_PIXEL_PTR(byte_run); |