generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/on2avc: Check run more carefully

Browse Source 
Fixes CID1239106

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 22f15f5735)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2015-05-14 01:01:35 +02:00
parent 4858ee1d9c
commit cdc4727766
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/on2avc.c
View File

@@ -119,12 +119,12 @@ static int on2avc_decode_band_types(On2AVCContext *c, GetBitContext *gb)
run_len = 1; run_len = 1;
do { do {
run = get_bits(gb, bits_per_sect); run = get_bits(gb, bits_per_sect);
run_len += run; if (run > num_bands - band - run_len) {
} while (run == esc_val);
if (band + run_len > num_bands) {
av_log(c->avctx, AV_LOG_ERROR, "Invalid band type run\n"); av_log(c->avctx, AV_LOG_ERROR, "Invalid band type run\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
run_len += run;
} while (run == esc_val);
for (i = band; i < band + run_len; i++) { for (i = band; i < band + run_len; i++) {
c->band_type[i] = band_type; c->band_type[i] = band_type;
c->band_run_end[i] = band + run_len; c->band_run_end[i] = band + run_len;