From 8097fc9a2dd49d8e467b16c8bafaa96242b7fe46 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Wed, 13 Feb 2013 20:46:08 +0100 Subject: 4xm: check the return value of read_huffman_tables(). CC:libav-stable@libav.org --- libavcodec/4xm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index fa5256c9ec..82f8417f0e 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -721,6 +721,10 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length) } prestream = read_huffman_tables(f, prestream); + if (!prestream) { + av_log(f->avctx, AV_LOG_ERROR, "Error reading Huffman tables.\n"); + return AVERROR_INVALIDDATA; + } init_get_bits(&f->gb, buf + 4, 8 * bitstream_size); -- cgit v1.2.3 From f935aca44c674d30e3ed940ef73bbad1228a5855 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Wed, 13 Feb 2013 21:36:25 +0100 Subject: av_memcpy_backptr: avoid an infinite loop for back = 0 CC:libav-stable@libav.org --- libavutil/mem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavutil/mem.c b/libavutil/mem.c index 3a4433d154..391eb7db38 100644 --- a/libavutil/mem.c +++ b/libavutil/mem.c @@ -252,6 +252,9 @@ static void fill32(uint8_t *dst, int len) void av_memcpy_backptr(uint8_t *dst, int back, int cnt) { const uint8_t *src = &dst[-back]; + if (!back) + return; + if (back == 1) { memset(dst, *src, cnt); } else if (back == 2) { -- cgit v1.2.3