Commit d2ad6f11 authored by James Almer's avatar James Almer

Merge commit '0ccddbad'

* commit '0ccddbad':
  smacker: limit recursion depth of smacker_decode_bigtree

See 946ecd19Merged-by: 's avatarJames Almer <jamrial@gmail.com>
parents b3e5899e 0ccddbad
......@@ -44,6 +44,7 @@
#define SMK_NODE 0x80000000
#define SMKTREE_DECODE_MAX_RECURSION 32
#define SMKTREE_DECODE_BIG_MAX_RECURSION 500
typedef struct SmackVContext {
AVCodecContext *avctx;
......@@ -131,12 +132,15 @@ static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t pref
/**
* Decode header tree
*/
static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx, int length)
static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc,
DBCtx *ctx, int length)
{
if(length > 500) { // Larger length can cause segmentation faults due to too deep recursion.
av_log(NULL, AV_LOG_ERROR, "length too long\n");
// Larger length can cause segmentation faults due to too deep recursion.
if (length > SMKTREE_DECODE_BIG_MAX_RECURSION) {
av_log(NULL, AV_LOG_ERROR, "Maximum bigtree recursion level exceeded.\n");
return AVERROR_INVALIDDATA;
}
if (hc->current + 1 >= hc->length) {
av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
return AVERROR_INVALIDDATA;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment