diff options
| author | Janne Grunau <janne-libav@jannau.net> | 2012-11-30 15:00:47 +0100 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2012-12-08 12:55:10 +0100 |
| commit | 9a2e79116d6235c53d8e9663a8d30d1950d7431a (patch) | |
| tree | dd8b6b351db8b31ed596f25434ddd052ff29d9e3 /libavcodec/golomb.h | |
| parent | 1c012e6bfb775eeb01355bfed7229c6795b3f3fc (diff) | |
| download | ffmpeg-9a2e79116d6235c53d8e9663a8d30d1950d7431a.tar.gz | |
golomb: use unsigned arithmetics in svq3_get_ue_golomb()
This prevents undefined behaviour of signed left shift if the coded
value is larger than 2^31. Large values are most likely invalid and
caused errors or by feeding random.
Validate every use of svq3_get_ue_golomb() and changed the place there
the return value was compared with negative numbers. dirac.c was clean,
fixed rv30 and svq3.
Diffstat (limited to 'libavcodec/golomb.h')
| -rw-r--r-- | libavcodec/golomb.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h index 6f95a67cff..564ba4e773 100644 --- a/libavcodec/golomb.h +++ b/libavcodec/golomb.h @@ -107,7 +107,8 @@ static inline int get_ue_golomb_31(GetBitContext *gb){ return ff_ue_golomb_vlc_code[buf]; } -static inline int svq3_get_ue_golomb(GetBitContext *gb){ +static inline unsigned svq3_get_ue_golomb(GetBitContext *gb) +{ uint32_t buf; OPEN_READER(re, gb); @@ -121,7 +122,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ return ff_interleaved_ue_golomb_vlc_code[buf]; }else{ - int ret = 1; + unsigned ret = 1; do { buf >>= 32 - 8; |