Commit f67a0d11 authored by Michael Niedermayer's avatar Michael Niedermayer

huffyuvdec: Check init_vlc() return codes.

Prevents out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 99b1b2b1
...@@ -124,6 +124,7 @@ static void generate_joint_tables(HYuvContext *s) ...@@ -124,6 +124,7 @@ static void generate_joint_tables(HYuvContext *s)
int len1 = s->len[p][u]; int len1 = s->len[p][u];
if (len1 > limit) if (len1 > limit)
continue; continue;
av_assert0(i < (1 << VLC_BITS));
len[i] = len0 + len1; len[i] = len0 + len1;
bits[i] = (s->bits[0][y] << len1) + s->bits[p][u]; bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
symbols[i] = (y << 8) + u; symbols[i] = (y << 8) + u;
...@@ -158,6 +159,7 @@ static void generate_joint_tables(HYuvContext *s) ...@@ -158,6 +159,7 @@ static void generate_joint_tables(HYuvContext *s)
int len2 = s->len[2][r & 255]; int len2 = s->len[2][r & 255];
if (len2 > limit1) if (len2 > limit1)
continue; continue;
av_assert0(i < (1 << VLC_BITS));
len[i] = len0 + len1 + len2; len[i] = len0 + len1 + len2;
bits[i] = (code << len2) + s->bits[2][r & 255]; bits[i] = (code << len2) + s->bits[2][r & 255];
if (s->decorrelate) { if (s->decorrelate) {
...@@ -182,6 +184,7 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length) ...@@ -182,6 +184,7 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)
{ {
GetBitContext gb; GetBitContext gb;
int i; int i;
int ret;
init_get_bits(&gb, src, length * 8); init_get_bits(&gb, src, length * 8);
...@@ -192,8 +195,9 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length) ...@@ -192,8 +195,9 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length)
return -1; return -1;
} }
ff_free_vlc(&s->vlc[i]); ff_free_vlc(&s->vlc[i]);
init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
s->bits[i], 4, 4, 0); s->bits[i], 4, 4, 0)) < 0)
return ret;
} }
generate_joint_tables(s); generate_joint_tables(s);
...@@ -205,6 +209,7 @@ static int read_old_huffman_tables(HYuvContext *s) ...@@ -205,6 +209,7 @@ static int read_old_huffman_tables(HYuvContext *s)
{ {
GetBitContext gb; GetBitContext gb;
int i; int i;
int ret;
init_get_bits(&gb, classic_shift_luma, init_get_bits(&gb, classic_shift_luma,
classic_shift_luma_table_size * 8); classic_shift_luma_table_size * 8);
...@@ -228,8 +233,9 @@ static int read_old_huffman_tables(HYuvContext *s) ...@@ -228,8 +233,9 @@ static int read_old_huffman_tables(HYuvContext *s)
for (i = 0; i < 3; i++) { for (i = 0; i < 3; i++) {
ff_free_vlc(&s->vlc[i]); ff_free_vlc(&s->vlc[i]);
init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1,
s->bits[i], 4, 4, 0); s->bits[i], 4, 4, 0)) < 0)
return ret;
} }
generate_joint_tables(s); generate_joint_tables(s);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment