From 8e104619a627fcf5f4c2bd3c09d0c2d323aae745 Mon Sep 17 00:00:00 2001
From: Vittorio Giovara <vittorio.giovara@gmail.com>
Date: Tue, 11 Nov 2014 17:40:08 +0100
Subject: shorten: check for return value

Avoid a possible negative bitshift.

CC: libav-stable@libav.org
Bug-Id: CID 1194400
---
 libavcodec/shorten.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'libavcodec/shorten.c')

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index c465fffe05..c93ba6b026 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -510,6 +510,8 @@ static int shorten_decode_frame(AVCodecContext *avctx, void *data,
                 break;
             case FN_BITSHIFT:
                 s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
+                if (s->bitshift < 0)
+                    return AVERROR_INVALIDDATA;
                 break;
             case FN_BLOCKSIZE: {
                 unsigned blocksize = get_uint(s, av_log2(s->blocksize));
-- 
cgit v1.2.3