eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/huffyuvdec: fix overread checks

Browse Source 
Fixes: ffvhuff_f.avi
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ba47d519e5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2014-08-11 15:16:29 +02:00
parent 6badd558ce
commit dbf5d7e5cd
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/huffyuvdec.c
+6 -6
View File
@@ -625,9 +625,9 @@ static void decode_422_bitstream(HYuvContext *s, int count)
READ_2PIX(s->temp[0][2 * i ], s->temp[1][i], 1);
READ_2PIX(s->temp[0][2 * i + 1], s->temp[2][i], 2);
}
for (; i < count && get_bits_left(&s->gb) > 0; i++) {
for (; i < count && BITS_LEFT(re, &s->gb) > 0; i++) {
READ_2PIX(s->temp[0][2 * i ], s->temp[1][i], 1);
if (get_bits_left(&s->gb) <= 0) break;
if (BITS_LEFT(re, &s->gb) <= 0) break;
READ_2PIX(s->temp[0][2 * i + 1], s->temp[2][i], 2);
}
for (; i < count; i++)
@@ -666,7 +666,7 @@ static void decode_plane_bitstream(HYuvContext *s, int count, int plane)
if (s->bps <= 8) {
OPEN_READER(re, &s->gb);
if (count >= (get_bits_left(&s->gb)) / (32 * 2)) {
for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) {
READ_2PIX_PLANE(s->temp[0][2 * i], s->temp[0][2 * i + 1], plane, OP8bits);
}
} else {
@@ -678,7 +678,7 @@ static void decode_plane_bitstream(HYuvContext *s, int count, int plane)
} else if (s->bps <= 14) {
OPEN_READER(re, &s->gb);
if (count >= (get_bits_left(&s->gb)) / (32 * 2)) {
for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) {
READ_2PIX_PLANE(s->temp16[0][2 * i], s->temp16[0][2 * i + 1], plane, OP14bits);
}
} else {
@@ -707,7 +707,7 @@ static void decode_gray_bitstream(HYuvContext *s, int count)
count/=2;
if (count >= (get_bits_left(&s->gb)) / (32 * 2)) {
for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) {
READ_2PIX(s->temp[0][2 * i], s->temp[0][2 * i + 1], 0);
}
} else {
@@ -724,7 +724,7 @@ static av_always_inline void decode_bgr_1(HYuvContext *s, int count,
int i;
OPEN_READER(re, &s->gb);
for (i = 0; i < count && get_bits_left(&s->gb) > 0; i++) {
for (i = 0; i < count && BITS_LEFT(re, &s->gb) > 0; i++) {
unsigned int index;
int code, n;