diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 22:45:57 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 22:52:57 +0100 |
| commit | d0f7927177077799abe540f9195b5ce1fc089183 (patch) | |
| tree | cd1f3a90f53d0c6192e143f45ad2e6858c9f3719 /libavcodec | |
| parent | ffa1f541b350946591ea80e134917b28a860fcad (diff) | |
smacker: Check for overread in smka_decode_frame()
Fixes a segfault with wetlog_fail.smk
Bug found by: Shitiz Garg
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/smacker.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index a983922fc7..fdc28e1a07 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -663,6 +663,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, for(i = 0; i <= stereo; i++) *samples++ = pred[i]; for(; i < unp_size / 2; i++) { + if(get_bits_left(&gb)<0) + return -1; if(i & stereo) { if(vlc[2].table) res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3); @@ -697,6 +699,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data, for(i = 0; i <= stereo; i++) *samples8++ = pred[i]; for(; i < unp_size; i++) { + if(get_bits_left(&gb)<0) + return -1; if(i & stereo){ if(vlc[1].table) res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3); |