diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-30 02:12:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-11-28 18:44:37 +0100 |
| commit | 8c8950f982c5473e5e95d3a7f421d8464be25471 (patch) | |
| tree | 0ae90ed040242c453dde47b349c403d1a71a1626 /libavcodec | |
| parent | 0f8863df86408b9e1ebb473274a2f1ddd8962604 (diff) | |
| download | ffmpeg-8c8950f982c5473e5e95d3a7f421d8464be25471.tar.gz | |
avcodec/snow: check coeffs for validity
Fixes deadlock
Fixes integer overflow
Fixes Ticket 3892
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 596636a474ab201badaae269f3a2cef4824b8c1f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/snow.h | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/snow.h b/libavcodec/snow.h index 60b00623a0..9910f3f6c1 100644 --- a/libavcodec/snow.h +++ b/libavcodec/snow.h @@ -655,7 +655,10 @@ static inline void unpack_coeffs(SnowContext *s, SubBand *b, SubBand * parent, i if(v){ v= 2*(get_symbol2(&s->c, b->state[context + 2], context-4) + 1); v+=get_rac(&s->c, &b->state[0][16 + 1 + 3 + ff_quant3bA[l&0xFF] + 3*ff_quant3bA[t&0xFF]]); - + if ((uint16_t)v != v) { + av_log(s->avctx, AV_LOG_ERROR, "Coefficient damaged\n"); + v = 1; + } xc->x=x; (xc++)->coeff= v; } @@ -665,6 +668,10 @@ static inline void unpack_coeffs(SnowContext *s, SubBand *b, SubBand * parent, i else run= INT_MAX; v= 2*(get_symbol2(&s->c, b->state[0 + 2], 0-4) + 1); v+=get_rac(&s->c, &b->state[0][16 + 1 + 3]); + if ((uint16_t)v != v) { + av_log(s->avctx, AV_LOG_ERROR, "Coefficient damaged\n"); + v = 1; + } xc->x=x; (xc++)->coeff= v; |