From c42640b20049517ce641e802935db28c7cdc32ae Mon Sep 17 00:00:00 2001
From: Reinhard Tartler <siretart@tauware.de>
Date: Tue, 9 Feb 2010 18:55:41 +0000
Subject: Fix a possibly exploitable buffer overflow.

backported r18640 by michael



Originally committed as revision 21712 to svn://svn.ffmpeg.org/ffmpeg/branches/0.5
---
 libavcodec/ffv1.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c
index 72c5fbd881..ccfcb62dc4 100644
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@@ -248,10 +248,9 @@ static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){
     else{
         int i, e, a;
         e= 0;
-        while(get_rac(c, state+1 + e)){ //1..10
+        while(get_rac(c, state+1 + e) && e<9){ //1..10
             e++;
         }
-        assert(e<=9);
 
         a= 1;
         for(i=e-1; i>=0; i--){
-- 
cgit v1.2.3