diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-29 17:52:21 +0000 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-29 22:07:03 +0200 |
| commit | e8050f313e7e3e1893155f878475872c4cc3a6e7 (patch) | |
| tree | 738cc8adda85840e5e7493b9090474298576db0a /libavcodec | |
| parent | be424d86a85af1d86d2a4d1bc3fede3d6078f796 (diff) | |
| download | ffmpeg-e8050f313e7e3e1893155f878475872c4cc3a6e7.tar.gz | |
apedec: check bits <= 32.
Fixes a floating-point exception further down.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
(cherry picked from commit 420d1df2e2a857eae45fa947e16eae7494793d57)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/apedec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index fa50d6178d..0abf05bd61 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -404,9 +404,12 @@ static inline int ape_decode_value(APEContext *ctx, APERice *rice) if (tmpk <= 16) x = range_decode_bits(ctx, tmpk); - else { + else if (tmpk <= 32) { x = range_decode_bits(ctx, 16); x |= (range_decode_bits(ctx, tmpk - 16) << 16); + } else { + av_log(ctx->avctx, AV_LOG_ERROR, "Too many bits: %d\n", tmpk); + return AVERROR_INVALIDDATA; } x += overflow << tmpk; } else { |