diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-02 04:04:29 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-02 04:18:13 +0200 |
| commit | 679c578cb8e82df6fdee977e3137a26a680ad346 (patch) | |
| tree | 64025aec3bcf830efe2e46746503c2bcd86fb4b3 /libavcodec/bmv.c | |
| parent | 9ebe6e391071690dbee79a645c51b14bd55c2ff4 (diff) | |
bmv: fix integer overflows in vlc decoder.
Fixes part of Ticket1373
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Based-on-patch-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/bmv.c')
| -rw-r--r-- | libavcodec/bmv.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/bmv.c b/libavcodec/bmv.c index 37c844858f..9740b11f15 100644 --- a/libavcodec/bmv.c +++ b/libavcodec/bmv.c @@ -21,6 +21,7 @@ #include "avcodec.h" #include "bytestream.h" +#include "libavutil/avassert.h" enum BMVFlags{ BMV_NOP = 0, @@ -52,7 +53,7 @@ typedef struct BMVDecContext { static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, int frame_off) { - int val, saved_val = 0; + unsigned val, saved_val = 0; int tmplen = src_len; const uint8_t *src, *source_end = source + src_len; uint8_t *frame_end = frame + SCREEN_WIDE * SCREEN_HIGH; @@ -98,6 +99,8 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, } if (!(val & 0xC)) { for (;;) { + if(shift>22) + return -1; if (!read_two_nibbles) { if (src < source || src >= source_end) return -1; @@ -131,6 +134,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, } advance_mode = val & 1; len = (val >> 1) - 1; + av_assert0(len>0); mode += 1 + advance_mode; if (mode >= 4) mode -= 3; |