diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-29 17:52:21 +0000 |
|---|---|---|
| committer | Derek Buitenhuis <derek.buitenhuis@gmail.com> | 2012-03-31 14:01:12 -0400 |
| commit | 420d1df2e2a857eae45fa947e16eae7494793d57 (patch) | |
| tree | 398a6cad5b2acd24561ba91bf2aa81c67f77b723 /libavcodec/apedec.c | |
| parent | c265b77b115885fd5f1b7a3eeae49dcc95718edc (diff) | |
apedec: check bits <= 32.
Fixes a floating-point exception further down.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
Signed-off-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Diffstat (limited to 'libavcodec/apedec.c')
| -rw-r--r-- | libavcodec/apedec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index a9953e1b31..1f982670f4 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -421,9 +421,12 @@ static inline int ape_decode_value(APEContext *ctx, APERice *rice) if (tmpk <= 16) x = range_decode_bits(ctx, tmpk); - else { + else if (tmpk <= 32) { x = range_decode_bits(ctx, 16); x |= (range_decode_bits(ctx, tmpk - 16) << 16); + } else { + av_log(ctx->avctx, AV_LOG_ERROR, "Too many bits: %d\n", tmpk); + return AVERROR_INVALIDDATA; } x += overflow << tmpk; } else { |