diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-28 03:16:01 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 00:48:58 +0100 |
| commit | 47faf347a0ed7c8a28232fa07ad0a53edccad7ac (patch) | |
| tree | 1ae32fb1bc7a50a0114d1ba7f5e5e7887600ecb5 /libavcodec | |
| parent | 3d1e4b7ca5d52762c0953b833fea2ee593a1b68f (diff) | |
| download | ffmpeg-47faf347a0ed7c8a28232fa07ad0a53edccad7ac.tar.gz | |
h264_cavlc: fix assertion failure due to reading too long vlc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 10ece44d0948b44b062d09319052d09d14f7bfdb)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/h264_cavlc.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c index 089d41aca4..1e979e5eff 100644 --- a/libavcodec/h264_cavlc.c +++ b/libavcodec/h264_cavlc.c @@ -549,9 +549,15 @@ static int decode_residual(H264Context *h, GetBitContext *gb, int16_t *block, in if(prefix<15){ level_code = (prefix<<suffix_length) + get_bits(gb, suffix_length); }else{ - level_code = (15<<suffix_length) + get_bits(gb, prefix-3); - if(prefix>=16) + level_code = 15<<suffix_length; + if (prefix>=16) { + if(prefix > 25+3){ + av_log(h->avctx, AV_LOG_ERROR, "Invalid level prefix\n"); + return AVERROR_INVALIDDATA; + } level_code += (1<<(prefix-3))-4096; + } + level_code += get_bits(gb, prefix-3); } mask= -(level_code&1); level_code= (((2+level_code)>>1) ^ mask) - mask; |