From 6a99310fce49f51773ab7d8ffa4f4748bbf58db9 Mon Sep 17 00:00:00 2001 From: Anton Khirnov Date: Sat, 29 Sep 2012 19:16:32 +0200 Subject: wmalosslessdec: Fix reading too many bits in decode_channel_residues() Fixes a part of CVE-2012-2795 CC:libav-stable@libav.org Based on a patch by Michael Niedermayer Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind --- libavcodec/wmalosslessdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavcodec/wmalosslessdec.c') diff --git a/libavcodec/wmalosslessdec.c b/libavcodec/wmalosslessdec.c index dc83b0607b..b97f39752c 100644 --- a/libavcodec/wmalosslessdec.c +++ b/libavcodec/wmalosslessdec.c @@ -520,7 +520,7 @@ static int decode_channel_residues(WmallDecodeCtx *s, int ch, int tile_size) residue = quo; else { rem_bits = av_ceil_log2(ave_mean); - rem = rem_bits ? get_bits(&s->gb, rem_bits) : 0; + rem = rem_bits ? get_bits_long(&s->gb, rem_bits) : 0; residue = (quo << rem_bits) + rem; } -- cgit v1.2.3