avcodec/ivi_common: make while get_bits loop more robust by checking bits left

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 6 insertions, 1 deletions

diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index 4179852d7b..ab4c9958c4 100644
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -1042,7 +1042,12 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
      */
     if (avctx->codec_id == AV_CODEC_ID_INDEO4 &&
         ctx->frame_type == 0/*FRAMETYPE_INTRA*/) {
-        while (get_bits(&ctx->gb, 8)); // skip version string
+            // skip version string
+        while (get_bits(&ctx->gb, 8)) {
+            if (get_bits_left(&ctx->gb) < 8)
+                return AVERROR_INVALIDDATA;
+        }
+
         skip_bits_long(&ctx->gb, 64);  // skip padding, TODO: implement correct 8-bytes alignment
         if (get_bits_left(&ctx->gb) > 18 && show_bits(&ctx->gb, 18) == 0x3FFF8)
             av_log(avctx, AV_LOG_ERROR, "Buffer contains IP frames!\n");