virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-07-11 14:30:22 +02:00
Code Issues Releases Activity

Merge commit '061c489895d29049a88dc6118e4b639a273b31d6'

Browse Source 
* commit '061c489895d29049a88dc6118e4b639a273b31d6':
  eamad: check for out of bounds read

Conflicts:
	libavcodec/eamad.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2015-02-23 21:29:35 +01:00
parent 92ec34707f 061c489895
commit cce8f750d9
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/eamad.c
View File

@ -151,6 +151,11 @@ static inline int decode_block_intra(MadContext *s, int16_t * block)
break; break;
} else if (level != 0) { } else if (level != 0) {
i += run; i += run;
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
return -1;
}
j = scantable[i]; j = scantable[i];
level = (level*quant_matrix[j]) >> 4; level = (level*quant_matrix[j]) >> 4;
level = (level-1)|1; level = (level-1)|1;
@ -165,6 +170,11 @@ static inline int decode_block_intra(MadContext *s, int16_t * block)
run = SHOW_UBITS(re, &s->gb, 6)+1; LAST_SKIP_BITS(re, &s->gb, 6); run = SHOW_UBITS(re, &s->gb, 6)+1; LAST_SKIP_BITS(re, &s->gb, 6);
i += run; i += run;
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
return -1;
}
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = -level; level = -level;
@ -176,10 +186,6 @@ static inline int decode_block_intra(MadContext *s, int16_t * block)
level = (level-1)|1; level = (level-1)|1;
} }
} }
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
return -1;
}
block[j] = level; block[j] = level;
} }