• Ronald S. Bultje's avatar
    truemotion: forbid invalid VLC bitsizes and token values. · b7b1509d
    Ronald S. Bultje authored
    SHOW_UBITS() is only defined up to n_bits is 25, therefore forbid
    values larger than this in get_vlc2() (max_bits). tokens[][] can be
    used as an index in deltas[], which has a size of 64, so ensure the
    values are smaller than that.
    
    This prevents crashes on corrupt bitstreams.
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    CC: libav-stable@libav.org
    b7b1509d
truemotion2.c 28.2 KB