diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-08-11 19:55:44 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-08-11 20:16:27 +0200 |
| commit | 961a1a81d88a05afabb895f8a9dd11e789a07d89 (patch) | |
| tree | 0fd45e3b442fc32fc0019cc7969e0746760aedb2 /libavcodec | |
| parent | 4ec86854354b8a852c7fa16f17045f649ba9defd (diff) | |
| download | ffmpeg-961a1a81d88a05afabb895f8a9dd11e789a07d89.tar.gz | |
cavsdec: check run value validity
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cavsdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 7beedb81b7..fcfe06e2ce 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -125,6 +125,8 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb, level_code = get_ue_code(gb,r->golomb_order); if(level_code >= ESCAPE_CODE) { run = ((level_code - ESCAPE_CODE) >> 1) + 1; + if(run > 64) + return -1; esc_code = get_ue_code(gb,esc_golomb_order); level = esc_code + (run > r->max_run ? 1 : r->level_add[run]); while(level > r->inc_limit) |