diff options
| author | Janne Grunau <janne-libav@jannau.net> | 2012-02-14 15:02:30 +0100 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2012-02-14 19:03:10 +0100 |
| commit | 18d1d5886bb78e4d0e11a2a0193fda765e05805d (patch) | |
| tree | 86a8f976d82759818bb1a58331fefecac9d3059d /libavcodec/rv30.c | |
| parent | 2af3dc8698707f800f83f5fc890571a6a119866e (diff) | |
| download | ffmpeg-18d1d5886bb78e4d0e11a2a0193fda765e05805d.tar.gz | |
rv30: check block type validity
Prevents crashes with the fuzzed samples from bugs 88, 89 and 125 after
"golomb: avoid infinite loop on all-zero input".
Diffstat (limited to 'libavcodec/rv30.c')
| -rw-r--r-- | libavcodec/rv30.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/rv30.c b/libavcodec/rv30.c index 4828e982b7..1bb223cd7b 100644 --- a/libavcodec/rv30.c +++ b/libavcodec/rv30.c @@ -103,7 +103,7 @@ static int rv30_decode_mb_info(RV34DecContext *r) GetBitContext *gb = &s->gb; int code = svq3_get_ue_golomb(gb); - if(code > 11){ + if (code < 0 || code > 11) { av_log(s->avctx, AV_LOG_ERROR, "Incorrect MB type code\n"); return -1; } |