Commit 00650803 authored by Michael Niedermayer's avatar Michael Niedermayer

proresdec: Fix read via negative index in a global array.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent e39487ef
...@@ -302,7 +302,7 @@ static av_always_inline void decode_dc_coeffs(GetBitContext *gb, DCTELEM *out, ...@@ -302,7 +302,7 @@ static av_always_inline void decode_dc_coeffs(GetBitContext *gb, DCTELEM *out,
code = 5; code = 5;
sign = 0; sign = 0;
for (i = 1; i < blocks_per_slice; i++, out += 64) { for (i = 1; i < blocks_per_slice; i++, out += 64) {
DECODE_CODEWORD(code, dc_codebook[FFMIN(code, 6)]); DECODE_CODEWORD(code, dc_codebook[FFMIN(code, 6U)]);
if(code) sign ^= -(code & 1); if(code) sign ^= -(code & 1);
else sign = 0; else sign = 0;
prev_dc += (((code + 1) >> 1) ^ sign) - sign; prev_dc += (((code + 1) >> 1) ^ sign) - sign;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment