diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-15 16:17:07 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-15 16:54:55 +0200 |
| commit | 1a974679d097e878401cc1a425c3ed612be1581e (patch) | |
| tree | b42e4a43997de85f043a6ad7f9af35822cdcd908 | |
| parent | cb8f5194b369f469dc04b78ada5f0e3a29f31b99 (diff) | |
qdm2: Check vlc_stage3_values index.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/qdm2.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavcodec/qdm2.c b/libavcodec/qdm2.c index 74a138bc70..0ba457d81e 100644 --- a/libavcodec/qdm2.c +++ b/libavcodec/qdm2.c @@ -343,7 +343,14 @@ static int qdm2_get_vlc (GetBitContext *gb, VLC *vlc, int flag, int depth) /* stage-3, optional */ if (flag) { - int tmp = vlc_stage3_values[value]; + int tmp; + + if (value >= 60) { + av_log(0, AV_LOG_ERROR, "value %d in qdm2_get_vlc too large\n", value); + return 0; + } + + tmp= vlc_stage3_values[value]; if ((value & ~3) > 0) tmp += get_bits (gb, (value >> 2)); |