diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-05-30 22:51:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-02 21:46:40 +0200 |
| commit | 5ee203076fa1b1b5da32f525f2b6df3bd5e93b09 (patch) | |
| tree | 8972998762782fc18e1c67eedf773121eec5bdff /libavcodec/vp3.c | |
| parent | af31084399b8ccbcf21a4994534871b4c41d7c7e (diff) | |
avcodec/vp3: Fix end of bitstream check in unpack_superblocks()
Fixes: regression
Found-by: Frank Liberato <liberato@google.com>
Tested-by: Frank Liberato <liberato@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/vp3.c')
| -rw-r--r-- | libavcodec/vp3.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index 2050090670..0e6da89abb 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -451,6 +451,7 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb) int i, j; int current_fragment; int plane; + int plane0_num_coded_frags = 0; if (s->keyframe) { memset(s->superblock_coding, SB_FULLY_CODED, s->superblock_count); @@ -543,8 +544,8 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb) : s->y_superblock_count); int num_coded_frags = 0; - for (i = sb_start; i < sb_end; i++) { - if (get_bits_left(gb) < ((s->total_num_coded_frags + num_coded_frags) >> 2)) { + for (i = sb_start; i < sb_end && get_bits_left(gb) > 0; i++) { + if (s->keyframe == 0 && get_bits_left(gb) < plane0_num_coded_frags >> 2) { return AVERROR_INVALIDDATA; } /* iterate through all 16 fragments in a superblock */ @@ -579,6 +580,8 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb) } } } + if (!plane) + plane0_num_coded_frags = num_coded_frags; s->total_num_coded_frags += num_coded_frags; for (i = 0; i < 64; i++) s->num_coded_frags[plane][i] = num_coded_frags; |