Commit eef5c35b authored by Michael Niedermayer's avatar Michael Niedermayer

vp3dec: Check coefficient index in vp3_dequant()

Fixes NGS00145

Found-by: Phillip Langlois
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 895d258e
......@@ -1309,6 +1309,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
case 1: // zero run
s->dct_tokens[plane][i]++;
i += (token >> 2) & 0x7f;
if(i>63){
av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
return -1;
}
block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
i++;
break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment