mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
avcodec/snow: check coeffs for validity
Fixes deadlock Fixes integer overflow Fixes Ticket 3892 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
d9e2aceb7f
commit
596636a474
@ -659,7 +659,10 @@ static inline void unpack_coeffs(SnowContext *s, SubBand *b, SubBand * parent, i
|
||||
if(v){
|
||||
v= 2*(get_symbol2(&s->c, b->state[context + 2], context-4) + 1);
|
||||
v+=get_rac(&s->c, &b->state[0][16 + 1 + 3 + ff_quant3bA[l&0xFF] + 3*ff_quant3bA[t&0xFF]]);
|
||||
|
||||
if ((uint16_t)v != v) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "Coefficient damaged\n");
|
||||
v = 1;
|
||||
}
|
||||
xc->x=x;
|
||||
(xc++)->coeff= v;
|
||||
}
|
||||
@ -669,6 +672,10 @@ static inline void unpack_coeffs(SnowContext *s, SubBand *b, SubBand * parent, i
|
||||
else run= INT_MAX;
|
||||
v= 2*(get_symbol2(&s->c, b->state[0 + 2], 0-4) + 1);
|
||||
v+=get_rac(&s->c, &b->state[0][16 + 1 + 3]);
|
||||
if ((uint16_t)v != v) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "Coefficient damaged\n");
|
||||
v = 1;
|
||||
}
|
||||
|
||||
xc->x=x;
|
||||
(xc++)->coeff= v;
|
||||
|
Loading…
Reference in New Issue
Block a user