From cf48b006400e34e1177d0ca22d1cdb5c900a199a Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Thu, 24 Jan 2013 21:55:12 +0100
Subject: cavsdec: check for value in get_ue_code()

Fixes integer overflow and prints an error in case the value is
invalid.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/cavsdec.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'libavcodec/cavsdec.c')

diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 9450ed137f..fa60d6c0eb 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -510,11 +510,15 @@ static inline void mv_pred_sym(AVSContext *h, cavs_vector *src,
 /** kth-order exponential golomb code */
 static inline int get_ue_code(GetBitContext *gb, int order)
 {
+    unsigned ret = get_ue_golomb(gb);
+    if (ret >= ((1U<<31)>>order)) {
+        av_log(NULL, AV_LOG_ERROR, "get_ue_code: value too larger\n");
+        return AVERROR_INVALIDDATA;
+    }
     if (order) {
-        int ret = get_ue_golomb(gb) << order;
-        return ret + get_bits(gb, order);
+        return (ret<<order) + get_bits(gb, order);
     }
-    return get_ue_golomb(gb);
+    return ret;
 }
 
 static inline int dequant(AVSContext *h, int16_t *level_buf, uint8_t *run_buf,
-- 
cgit v1.2.3