eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-16 03:50:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

eamad: check for out of bounds read

Browse Source 
Bug-Id: CID 1257500
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Federico Tomassetti
2015-02-18 12:11:44 +00:00
committed by Vittorio Giovara
parent 9841654c15
commit c17da32ba2
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/eamad.c
View File

@@ -134,6 +134,11 @@ static inline void decode_block_intra(MadContext *s, DCTELEM * block)
break;
} else if (level != 0) {
i += run;
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
return;
}
j = scantable[i];
level = (level*quant_matrix[j]) >> 4;
level = (level-1)|1;
@@ -148,6 +153,11 @@ static inline void decode_block_intra(MadContext *s, DCTELEM * block)
run = SHOW_UBITS(re, &s->gb, 6)+1; LAST_SKIP_BITS(re, &s->gb, 6);
i += run;
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
return;
}
j = scantable[i];
if (level < 0) {
level = -level;
@@ -159,10 +169,6 @@ static inline void decode_block_intra(MadContext *s, DCTELEM * block)
level = (level-1)|1;
}
}
if (i > 63) {
av_log(s->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
return;
}
block[j] = level;
}