virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avcodec/bitstream: Check bits in ff_init_vlc_sparse()

Browse Source 
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-04-18 02:47:10 +02:00
parent bdfe60c769
commit fb3e3808ae
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/bitstream.c
View File

@ -305,6 +305,10 @@ int ff_init_vlc_sparse(VLC *vlc, int nb_bits, int nb_codes,
GET_DATA(buf[j].bits, bits, i, bits_wrap, bits_size);\ GET_DATA(buf[j].bits, bits, i, bits_wrap, bits_size);\
if (!(condition))\ if (!(condition))\
continue;\ continue;\
if (buf[j].bits > 3*nb_bits || buf[j].bits>32) {\
av_log(NULL, AV_LOG_ERROR, "Too long VLC in init_vlc\n");\
return -1;\
}\
GET_DATA(buf[j].code, codes, i, codes_wrap, codes_size);\ GET_DATA(buf[j].code, codes, i, codes_wrap, codes_size);\
if (flags & INIT_VLC_LE)\ if (flags & INIT_VLC_LE)\
buf[j].code = bitswap_32(buf[j].code);\ buf[j].code = bitswap_32(buf[j].code);\