Commit 92ec3470 authored by Michael Niedermayer's avatar Michael Niedermayer

Merge commit '161442ff'

* commit '161442ff':
  mdec: check for out of bounds read
Merged-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parents 596f81c7 161442ff
......@@ -89,6 +89,11 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n)
break;
} else if (level != 0) {
i += run;
if (i > 63) {
av_log(a->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", a->mb_x, a->mb_y);
return AVERROR_INVALIDDATA;
}
j = scantable[i];
level = (level * qscale * quant_matrix[j]) >> 3;
level = (level ^ SHOW_SBITS(re, &a->gb, 1)) - SHOW_SBITS(re, &a->gb, 1);
......@@ -99,6 +104,11 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n)
UPDATE_CACHE(re, &a->gb);
level = SHOW_SBITS(re, &a->gb, 10); SKIP_BITS(re, &a->gb, 10);
i += run;
if (i > 63) {
av_log(a->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", a->mb_x, a->mb_y);
return AVERROR_INVALIDDATA;
}
j = scantable[i];
if (level < 0) {
level = -level;
......@@ -110,10 +120,6 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n)
level = (level - 1) | 1;
}
}
if (i > 63) {
av_log(a->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", a->mb_x, a->mb_y);
return AVERROR_INVALIDDATA;
}
block[j] = level;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment