From d5d5f960688717a4dede2fbbde35003d8ec9b493 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 31 May 2012 18:54:00 +0200 Subject: [PATCH] mpeg4videodec: Check that cplx_estimation_* fits in the available space Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit b02cc2ddc610cd84bbee5923a642a8324988b28c) Signed-off-by: Michael Niedermayer --- libavcodec/mpeg4videodec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index bd1910b3ad..263ac991d8 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -2050,6 +2050,10 @@ static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){ if(s->pict_type == AV_PICTURE_TYPE_B) skip_bits_long(gb, s->cplx_estimation_trash_b); + if(get_bits_left(gb) < 3) { + av_log(s->avctx, AV_LOG_ERROR, "Header truncated\n"); + return -1; + } s->intra_dc_threshold= ff_mpeg4_dc_threshold[ get_bits(gb, 3) ]; if(!s->progressive_sequence){ s->top_field_first= get_bits1(gb);