1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-15 14:13:16 +02:00

svq1dec: Validate the stages value strictly

It can be less than -1.

Bug-Id: CID 1194397 / CID 1194398
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato
2015-02-02 02:22:34 +01:00
committed by Vittorio Giovara
parent 6f7a32839d
commit 9b8c8a9395

View File

@@ -191,7 +191,7 @@ static int svq1_decode_block_intra(GetBitContext *bitbuf, uint8_t *pixels,
continue; /* skip vector */ continue; /* skip vector */
} }
if (stages > 0 && level >= 4) { if ((stages > 0 && level >= 4) || stages < 0) {
av_dlog(NULL, av_dlog(NULL,
"Error (svq1_decode_block_intra): invalid vector: stages=%i level=%i\n", "Error (svq1_decode_block_intra): invalid vector: stages=%i level=%i\n",
stages, level); stages, level);
@@ -253,7 +253,7 @@ static int svq1_decode_block_non_intra(GetBitContext *bitbuf, uint8_t *pixels,
if (stages == -1) if (stages == -1)
continue; /* skip vector */ continue; /* skip vector */
if ((stages > 0) && (level >= 4)) { if ((stages > 0 && level >= 4) || stages < 0) {
av_dlog(NULL, av_dlog(NULL,
"Error (svq1_decode_block_non_intra): invalid vector: stages=%i level=%i\n", "Error (svq1_decode_block_non_intra): invalid vector: stages=%i level=%i\n",
stages, level); stages, level);