diff options
author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-12-07 13:09:20 -0800 |
---|---|---|
committer | Luca Barbato <lu_zero@gentoo.org> | 2012-12-08 17:04:22 +0100 |
commit | ddd7559ad97d3cde401ce096262af6375685ea22 (patch) | |
tree | 20ec9ed5e605b769902df27c6589e828ba00fdfd /libavcodec | |
parent | 9a2e79116d6235c53d8e9663a8d30d1950d7431a (diff) | |
download | ffmpeg-ddd7559ad97d3cde401ce096262af6375685ea22.tar.gz |
h264: check for invalid zeros_left before writing
Prevent an invalid write into coeffs[scantable[-1]] if zeros_left
itself was an invalid VLC code (and thus -1).
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/h264_cavlc.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c index 87021229d4..0cc7214666 100644 --- a/libavcodec/h264_cavlc.c +++ b/libavcodec/h264_cavlc.c @@ -610,17 +610,18 @@ static int decode_residual(H264Context *h, GetBitContext *gb, DCTELEM *block, in } \ } + if (zeros_left < 0) { + av_log(h->s.avctx, AV_LOG_ERROR, + "negative number of zero coeffs at %d %d\n", s->mb_x, s->mb_y); + return AVERROR_INVALIDDATA; + } + if (h->pixel_shift) { STORE_BLOCK(int32_t) } else { STORE_BLOCK(int16_t) } - if(zeros_left<0){ - av_log(h->s.avctx, AV_LOG_ERROR, "negative number of zero coeffs at %d %d\n", s->mb_x, s->mb_y); - return -1; - } - return 0; } |