From bc4350a333f6eafab046922fd5e42ab8759a4a04 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 9 Apr 2009 18:37:26 +0000 Subject: Check spatial_decomposition_count too, fixes another crash. Originally committed as revision 18392 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/snow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/snow.c b/libavcodec/snow.c index 44cfd44983..a6718f8d39 100644 --- a/libavcodec/snow.c +++ b/libavcodec/snow.c @@ -3581,7 +3581,7 @@ static int decode_header(SnowContext *s){ s->always_reset= get_rac(&s->c, s->header_state); s->temporal_decomposition_type= get_symbol(&s->c, s->header_state, 0); s->temporal_decomposition_count= get_symbol(&s->c, s->header_state, 0); - s->spatial_decomposition_count= get_symbol(&s->c, s->header_state, 0); + GET_S(s->spatial_decomposition_count, tmp <= (unsigned)MAX_DECOMPOSITIONS) s->colorspace_type= get_symbol(&s->c, s->header_state, 0); s->chroma_h_shift= get_symbol(&s->c, s->header_state, 0); s->chroma_v_shift= get_symbol(&s->c, s->header_state, 0); @@ -3614,7 +3614,7 @@ static int decode_header(SnowContext *s){ memcpy(s->plane[2].hcoeff, s->plane[1].hcoeff, sizeof(s->plane[1].hcoeff)); } if(get_rac(&s->c, s->header_state)){ - s->spatial_decomposition_count= get_symbol(&s->c, s->header_state, 0); + GET_S(s->spatial_decomposition_count, tmp <= (unsigned)MAX_DECOMPOSITIONS) decode_qlogs(s); } } -- cgit v1.2.3