diff options
| author | James Almer <jamrial@gmail.com> | 2017-11-12 01:08:10 -0300 |
|---|---|---|
| committer | James Almer <jamrial@gmail.com> | 2017-11-12 01:12:44 -0300 |
| commit | b3e5899e475d02dc0730e9405b4c067c8c78d8f4 (patch) | |
| tree | ebd89ea2b6739f8e60f09fd10ab6a7d5f5dda5dd /libavcodec | |
| parent | ccf7bca1c9bb49bcb1542139eb1b6a0febf4d37e (diff) | |
| parent | cd4663dc80323ba64989d0c103d51ad3ee0e9c2f (diff) | |
| download | ffmpeg-b3e5899e475d02dc0730e9405b4c067c8c78d8f4.tar.gz | |
Merge commit 'cd4663dc80323ba64989d0c103d51ad3ee0e9c2f'
* commit 'cd4663dc80323ba64989d0c103d51ad3ee0e9c2f':
smacker: add sanity check for length in smacker_decode_tree()
See b829da363985cb2f80130bba304cc29a632f6446
Merged-by: James Almer <jamrial@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/smacker.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index dad899c791..2077dde4a1 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -43,6 +43,7 @@ #define SMKTREE_BITS 9 #define SMK_NODE 0x80000000 +#define SMKTREE_DECODE_MAX_RECURSION 32 typedef struct SmackVContext { AVCodecContext *avctx; @@ -95,10 +96,11 @@ enum SmkBlockTypes { */ static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length) { - if(length > 32 || length > 3*SMKTREE_BITS) { - av_log(NULL, AV_LOG_ERROR, "length too long\n"); + if (length > SMKTREE_DECODE_MAX_RECURSION || length > 3 * SMKTREE_BITS) { + av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n"); return AVERROR_INVALIDDATA; } + if(!get_bits1(gb)){ //Leaf if(hc->current >= hc->length){ av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n"); |