Commit c6643fdd authored by Ronald S. Bultje's avatar Ronald S. Bultje

golomb: avoid infinite loop on all-zero input (or end of buffer).

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
parent c9fdf324
...@@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ ...@@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
}else{ }else{
int ret = 1; int ret = 1;
while (1) { do {
buf >>= 32 - 8; buf >>= 32 - 8;
LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8)); LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8));
...@@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ ...@@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf]; ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf];
UPDATE_CACHE(re, gb); UPDATE_CACHE(re, gb);
buf = GET_CACHE(re, gb); buf = GET_CACHE(re, gb);
} } while (ret);
CLOSE_READER(re, gb); CLOSE_READER(re, gb);
return ret - 1; return ret - 1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment