diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-09 18:37:53 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-09 18:44:01 +0100 |
| commit | 4401958fdc9abd3551dd1903bd6d30890329b448 (patch) | |
| tree | 17cd5136bdeece54922b7abe0933716f063957f9 /libavcodec | |
| parent | e149127bb217a5a5890fc6f1fd9e0cf69db710bc (diff) | |
| download | ffmpeg-4401958fdc9abd3551dd1903bd6d30890329b448.tar.gz | |
motionpixels: Propagate errors in vlc table init
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/motionpixels.c | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c index 61a718c5a9..f69cd569e2 100644 --- a/libavcodec/motionpixels.c +++ b/libavcodec/motionpixels.c @@ -101,38 +101,44 @@ static void mp_read_changes_map(MotionPixelsContext *mp, GetBitContext *gb, int } } -static void mp_get_code(MotionPixelsContext *mp, GetBitContext *gb, int size, int code) +static int mp_get_code(MotionPixelsContext *mp, GetBitContext *gb, int size, int code) { while (get_bits1(gb)) { ++size; if (size > mp->max_codes_bits) { av_log(mp->avctx, AV_LOG_ERROR, "invalid code size %d/%d\n", size, mp->max_codes_bits); - return; + return AVERROR_INVALIDDATA; } code <<= 1; - mp_get_code(mp, gb, size, code + 1); + if (mp_get_code(mp, gb, size, code + 1) < 0) + return AVERROR_INVALIDDATA; } if (mp->current_codes_count >= MAX_HUFF_CODES) { av_log(mp->avctx, AV_LOG_ERROR, "too many codes\n"); - return; + return AVERROR_INVALIDDATA; } + mp->codes[mp->current_codes_count ].code = code; mp->codes[mp->current_codes_count++].size = size; + return 0; } -static void mp_read_codes_table(MotionPixelsContext *mp, GetBitContext *gb) +static int mp_read_codes_table(MotionPixelsContext *mp, GetBitContext *gb) { if (mp->codes_count == 1) { mp->codes[0].delta = get_bits(gb, 4); } else { int i; + int ret; mp->max_codes_bits = get_bits(gb, 4); for (i = 0; i < mp->codes_count; ++i) mp->codes[i].delta = get_bits(gb, 4); mp->current_codes_count = 0; - mp_get_code(mp, gb, 0, 0); + if ((ret = mp_get_code(mp, gb, 0, 0)) < 0) + return ret; } + return 0; } static int mp_gradient(MotionPixelsContext *mp, int component, int v) @@ -287,7 +293,8 @@ static int mp_decode_frame(AVCodecContext *avctx, *(uint16_t *)mp->frame.data[0] = get_bits(&gb, 15); mp->changes_map[0] = 1; } - mp_read_codes_table(mp, &gb); + if (mp_read_codes_table(mp, &gb) < 0) + goto end; sz = get_bits(&gb, 18); if (avctx->extradata[0] != 5) |