diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-31 18:54:00 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-31 20:25:23 +0200 |
| commit | b02cc2ddc610cd84bbee5923a642a8324988b28c (patch) | |
| tree | 308c383191137d66d8d7fc72a15c4cc25f25dae3 /libavcodec | |
| parent | 06bf6d3bc04979bd39ecdc7311d0daf8aee7e10f (diff) | |
| download | ffmpeg-b02cc2ddc610cd84bbee5923a642a8324988b28c.tar.gz | |
mpeg4videodec: Check that cplx_estimation_* fits in the available space
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mpeg4videodec.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index bd1910b3ad..263ac991d8 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -2050,6 +2050,10 @@ static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){ if(s->pict_type == AV_PICTURE_TYPE_B) skip_bits_long(gb, s->cplx_estimation_trash_b); + if(get_bits_left(gb) < 3) { + av_log(s->avctx, AV_LOG_ERROR, "Header truncated\n"); + return -1; + } s->intra_dc_threshold= ff_mpeg4_dc_threshold[ get_bits(gb, 3) ]; if(!s->progressive_sequence){ s->top_field_first= get_bits1(gb); |