diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-29 10:25:04 -0700 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-29 22:07:03 +0200 |
| commit | be424d86a85af1d86d2a4d1bc3fede3d6078f796 (patch) | |
| tree | 816d71191bb5fc6a47a556913d6877c4f55d8319 /libavcodec/h263dec.c | |
| parent | a08cb950b25d31ecc9c083dc8f70b30ec3c70cc9 (diff) | |
| download | ffmpeg-be424d86a85af1d86d2a4d1bc3fede3d6078f796.tar.gz | |
truemotion: forbid invalid VLC bitsizes and token values.
SHOW_UBITS() is only defined up to n_bits is 25, therefore forbid
values larger than this in get_vlc2() (max_bits). tokens[][] can be
used as an index in deltas[], which has a size of 64, so ensure the
values are smaller than that.
This prevents crashes on corrupt bitstreams.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit b7b1509d06d3696d3b944791227fe198ded0654b)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec/h263dec.c')
0 files changed, 0 insertions, 0 deletions