virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

Merge commit 'cd4663dc80323ba64989d0c103d51ad3ee0e9c2f'

Browse Source 
* commit 'cd4663dc80323ba64989d0c103d51ad3ee0e9c2f':
  smacker: add sanity check for length in smacker_decode_tree()

See b829da3639

Merged-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2017-11-12 01:08:10 -03:00
commit b3e5899e47
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/smacker.c
View File

@ -43,6 +43,7 @@
#define SMKTREE_BITS 9
#define SMK_NODE 0x80000000
#define SMKTREE_DECODE_MAX_RECURSION 32
typedef struct SmackVContext {
AVCodecContext *avctx;
@ -95,10 +96,11 @@ enum SmkBlockTypes {
*/
static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length)
{
if(length > 32 || length > 3*SMKTREE_BITS) {
av_log(NULL, AV_LOG_ERROR, "length too long\n");
if (length > SMKTREE_DECODE_MAX_RECURSION || length > 3 * SMKTREE_BITS) {
av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
return AVERROR_INVALIDDATA;
}
if(!get_bits1(gb)){ //Leaf
if(hc->current >= hc->length){
av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");