diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-09-23 05:42:31 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-09-26 20:38:30 +0200 |
| commit | 85737a4d76f8a39ec5554abe62bcbc41b6123d09 (patch) | |
| tree | ebdde9d898ef8a48e5ebe62aba753d8cf14140d0 /libavcodec | |
| parent | 94dc3385e498ee408275fdf9107b995afa917115 (diff) | |
avcodec/magicyuv: Improve overread check when parsing Huffman tables
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/magicyuv.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c index b56d3e9d32..d2f6a9b01e 100644 --- a/libavcodec/magicyuv.c +++ b/libavcodec/magicyuv.c @@ -394,8 +394,13 @@ static int build_huffman(AVCodecContext *avctx, GetBitContext *gbit, int max) while (get_bits_left(gbit) >= 8) { int b = get_bits(gbit, 1); int x = get_bits(gbit, 7); - int l = get_bitsz(gbit, b * 8) + 1; + int l = 1; + if (b) { + if (get_bits_left(gbit) < 8) + break; + l += get_bits(gbit, 8); + } k = j + l; if (k > max || x == 0 || x > 32) { av_log(avctx, AV_LOG_ERROR, "Invalid Huffman codes\n"); |