diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-21 16:01:52 +0200 |
|---|---|---|
| committer | Sean McGovern <gseanmcg@gmail.com> | 2017-11-10 20:38:44 -0500 |
| commit | cd4663dc80323ba64989d0c103d51ad3ee0e9c2f (patch) | |
| tree | a792d0183035645c19330ec674e25339806f0985 /libavcodec/smacker.c | |
| parent | 17b6c7efb471e8ff1b8a7271f6531ba1d52bf69c (diff) | |
smacker: add sanity check for length in smacker_decode_tree()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
Diffstat (limited to 'libavcodec/smacker.c')
| -rw-r--r-- | libavcodec/smacker.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index 0e057a1c2a..7deccffa54 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -43,7 +43,7 @@ #define SMKTREE_BITS 9 #define SMK_NODE 0x80000000 - +#define SMKTREE_DECODE_MAX_RECURSION 32 typedef struct SmackVContext { AVCodecContext *avctx; @@ -97,6 +97,11 @@ enum SmkBlockTypes { static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc, uint32_t prefix, int length) { + if (length > SMKTREE_DECODE_MAX_RECURSION) { + av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n"); + return AVERROR_INVALIDDATA; + } + if (!bitstream_read_bit(bc)) { // Leaf if(hc->current >= 256){ av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n"); |