aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/golomb.h
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2015-12-13 21:02:16 +0100
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2015-12-14 20:51:39 +0100
commit22e960ad478e568f4094971a58c6ad8f549c0180 (patch)
tree475e81145195fa329b3ab22eefa65c0ceafdd474 /libavcodec/golomb.h
parent1925eaeaa6f2582660571701d4f20d102b960e4a (diff)
downloadffmpeg-22e960ad478e568f4094971a58c6ad8f549c0180.tar.gz
golomb: always check for invalid UE golomb codes in get_ue_golomb
Also correct the check to reject log < 7, because UPDATE_CACHE only guarantees 25 meaningful bits. This fixes undefined behavior: runtime error: shift exponent is negative Testing with START/STOP timers in get_ue_golomb, one for the first branch (A) and one for the second (B), shows that there is practically no slowdown, e.g. for the cavs decoder: With the check in the B branch: 629 decicycles in get_ue_golomb B, 4194260 runs, 44 skips 433 decicycles in get_ue_golomb A,268434102 runs, 1354 skips Without the check: 624 decicycles in get_ue_golomb B, 4194273 runs, 31 skips 433 decicycles in get_ue_golomb A,268434203 runs, 1253 skips Since the B branch is executed far less often than the A branch, this change is negligible, even more so for the h264 decoder, where the ratio B/A is a lot smaller. Fixes: mozilla bug 1230239 Fixes: fbeb8b2c7c996e9b91c6b1af319d7ebc/asan_heap-oob_195450f_2743_e8856ece4579ea486670be2b236099a0.bit Found-by: Tyson Smith Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavcodec/golomb.h')
-rw-r--r--libavcodec/golomb.h2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
index d30bb6bc86..5136a04845 100644
--- a/libavcodec/golomb.h
+++ b/libavcodec/golomb.h
@@ -68,7 +68,7 @@ static inline int get_ue_golomb(GetBitContext *gb)
int log = 2 * av_log2(buf) - 31;
LAST_SKIP_BITS(re, gb, 32 - log);
CLOSE_READER(re, gb);
- if (CONFIG_FTRAPV && log < 0) {
+ if (log < 7) {
av_log(NULL, AV_LOG_ERROR, "Invalid UE golomb code\n");
return AVERROR_INVALIDDATA;
}