virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-04 22:03:09 +02:00
Code Issues Releases Activity

avcodec/webp: Check before allocations

Browse Source 
Avoids freeing lateron.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt
2025-04-20 20:32:20 +02:00
parent e0df21b8c3
commit 1fc0ee484f
1 changed files with 12 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/webp.c
View File

@ -341,6 +341,18 @@ static int read_huffman_code_normal(WebPContext *s, HuffReader *hc,
len_counts[len]++; len_counts[len]++;
} }
if (get_bits1(&s->gb)) {
int bits = 2 + 2 * get_bits(&s->gb, 3);
max_symbol = 2 + get_bits(&s->gb, bits);
if (max_symbol > alphabet_size) {
av_log(s->avctx, AV_LOG_ERROR, "max symbol %d > alphabet size %d\n",
max_symbol, alphabet_size);
return AVERROR_INVALIDDATA;
}
} else {
max_symbol = alphabet_size;
}
ret = huff_reader_build_canonical(&code_len_hc, code_length_code_lengths, len_counts, ret = huff_reader_build_canonical(&code_len_hc, code_length_code_lengths, len_counts,
NUM_CODE_LENGTH_CODES, s->avctx); NUM_CODE_LENGTH_CODES, s->avctx);
if (ret < 0) if (ret < 0)
@ -352,19 +364,6 @@ static int read_huffman_code_normal(WebPContext *s, HuffReader *hc,
goto finish; goto finish;
} }
if (get_bits1(&s->gb)) {
int bits = 2 + 2 * get_bits(&s->gb, 3);
max_symbol = 2 + get_bits(&s->gb, bits);
if (max_symbol > alphabet_size) {
av_log(s->avctx, AV_LOG_ERROR, "max symbol %d > alphabet size %d\n",
max_symbol, alphabet_size);
ret = AVERROR_INVALIDDATA;
goto finish;
}
} else {
max_symbol = alphabet_size;
}
prev_code_len = 8; prev_code_len = 8;
symbol = 0; symbol = 0;
memset(len_counts, 0, sizeof(len_counts)); memset(len_counts, 0, sizeof(len_counts));