virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/vp3: Fix end of bitstream check in unpack_superblocks()

Browse Source 
Fixes: regression

Found-by: Frank Liberato <liberato@google.com>
Tested-by: Frank Liberato <liberato@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-05-30 22:51:33 +02:00
parent af31084399
commit 5ee203076f
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/vp3.c
View File

@ -451,6 +451,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
int i, j;
int current_fragment;
int plane;
int plane0_num_coded_frags = 0;
if (s->keyframe) {
memset(s->superblock_coding, SB_FULLY_CODED, s->superblock_count);
@ -543,8 +544,8 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
: s->y_superblock_count);
int num_coded_frags = 0;
for (i = sb_start; i < sb_end; i++) {
if (get_bits_left(gb) < ((s->total_num_coded_frags + num_coded_frags) >> 2)) {
for (i = sb_start; i < sb_end && get_bits_left(gb) > 0; i++) {
if (s->keyframe == 0 && get_bits_left(gb) < plane0_num_coded_frags >> 2) {
return AVERROR_INVALIDDATA;
}
/* iterate through all 16 fragments in a superblock */
@ -579,6 +580,8 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
}
}
}
if (!plane)
plane0_num_coded_frags = num_coded_frags;
s->total_num_coded_frags += num_coded_frags;
for (i = 0; i < 64; i++)
s->num_coded_frags[plane][i] = num_coded_frags;