From ddfe1246d98f70cdce368a2176196ba26ed7bf2d Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Thu, 14 Feb 2013 12:40:36 +0100 Subject: flicvideo: avoid an infinite loop in byte run compression When byte_run is 0, pixel_countdown is not touched and the loop will run forever. CC:libav-stable@libav.org --- libavcodec/flicvideo.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'libavcodec/flicvideo.c') diff --git a/libavcodec/flicvideo.c b/libavcodec/flicvideo.c index f0b5d50d02..08c3ef32a8 100644 --- a/libavcodec/flicvideo.c +++ b/libavcodec/flicvideo.c @@ -348,6 +348,11 @@ static int flic_decode_frame_8BPP(AVCodecContext *avctx, pixel_countdown = s->avctx->width; while (pixel_countdown > 0) { byte_run = sign_extend(bytestream2_get_byte(&g2), 8); + if (!byte_run) { + av_log(avctx, AV_LOG_ERROR, "Invalid byte run value.\n"); + return AVERROR_INVALIDDATA; + } + if (byte_run > 0) { palette_idx1 = bytestream2_get_byte(&g2); CHECK_PIXEL_PTR(byte_run); -- cgit v1.2.3