diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 21:47:09 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 21:50:17 +0100 |
| commit | bd953f94044eec49142d3d61993682f8b2186613 (patch) | |
| tree | 0897070724eff4c17732c2cac1ab80a4cc9312b1 /libavcodec/smacker.c | |
| parent | 9e96051d5d03c13692090bff5c804fa5aaa11375 (diff) | |
| parent | 486c45767587151b517bb6fde602d43d178da203 (diff) | |
| download | ffmpeg-bd953f94044eec49142d3d61993682f8b2186613.tar.gz | |
Merge commit '486c45767587151b517bb6fde602d43d178da203' into release/0.10
* commit '486c45767587151b517bb6fde602d43d178da203':
mpc8: Check the seek table size parsed from the bitstream
zmbvdec: Check the buffer size for uncompressed data
ape: Don't allow the seektable to be omitted
shorten: Break out of loop looking for fmt chunk if none is found
shorten: Use a checked bytestream reader for the wave header
smacker: Make sure we don't fill in huffman codes out of range
Conflicts:
libavcodec/shorten.c
libavcodec/smacker.c
libavcodec/zmbv.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/smacker.c')
| -rw-r--r-- | libavcodec/smacker.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 418538378e..3b048e429b 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -263,10 +263,11 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int if(ctx.last[0] == -1) ctx.last[0] = huff.current++; if(ctx.last[1] == -1) ctx.last[1] = huff.current++; if(ctx.last[2] == -1) ctx.last[2] = huff.current++; - if(huff.current > huff.length){ - ctx.last[0] = ctx.last[1] = ctx.last[2] = 1; - av_log(smk->avctx, AV_LOG_ERROR, "bigtree damaged\n"); - return -1; + if (ctx.last[0] >= huff.length || + ctx.last[1] >= huff.length || + ctx.last[2] >= huff.length) { + av_log(smk->avctx, AV_LOG_ERROR, "Huffman codes out of range\n"); + err = AVERROR_INVALIDDATA; } *recodes = huff.values; |