Commit f48fbf2e authored by Michael Niedermayer's avatar Michael Niedermayer Committed by Anton Khirnov

wmalosslessdec: fix a get_bits(0) in decode_ac_filter

Fixes a part of CVE-2012-2795

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarAnton Khirnov <anton@khirnov.net>
parent 607f5715
......@@ -406,7 +406,8 @@ static void decode_ac_filter(WmallDecodeCtx *s)
s->acfilter_scaling = get_bits(&s->gb, 4);
for (i = 0; i < s->acfilter_order; i++)
s->acfilter_coeffs[i] = get_bits(&s->gb, s->acfilter_scaling) + 1;
s->acfilter_coeffs[i] = (s->acfilter_scaling ?
get_bits(&s->gb, s->acfilter_scaling) : 0) + 1;
}
static void decode_mclms(WmallDecodeCtx *s)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment