diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-14 11:50:57 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-02-26 10:03:14 +0100 |
| commit | e1f2a6a32b86fef0916338e21851c9b4f499f706 (patch) | |
| tree | 98e7db6d003442d5b4729e348fcde165f19a2ee5 | |
| parent | 6fc3287b9ccece290c5881b92948772bbf72e68c (diff) | |
| download | ffmpeg-e1f2a6a32b86fef0916338e21851c9b4f499f706.tar.gz | |
golomb: avoid infinite loop on all-zero input (or end of buffer).
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c6643fddba73560f26f90d327c84d8832222a720)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/golomb.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h index 503aa1416a..e19064c642 100644 --- a/libavcodec/golomb.h +++ b/libavcodec/golomb.h @@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ }else{ int ret = 1; - while (1) { + do { buf >>= 32 - 8; LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8)); @@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf]; UPDATE_CACHE(re, gb); buf = GET_CACHE(re, gb); - } + } while (ret); CLOSE_READER(re, gb); return ret - 1; |