Alex Converse <[email protected]> writes:
> From: Thierry Foucu <[email protected]>
>
> Found with Address Sanitizer
> ---
> libavcodec/vp6.c | 8 +++++---
> 1 files changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/vp6.c b/libavcodec/vp6.c
> index 03024fa..b594003 100644
> --- a/libavcodec/vp6.c
> +++ b/libavcodec/vp6.c
> @@ -442,7 +442,7 @@ static void vp6_parse_coeff(VP56Context *s)
> model1 = model->coeff_dccv[pt];
> model2 = model->coeff_dcct[pt][ctx];
>
> - for (coeff_idx=0; coeff_idx<64; ) {
> + for (coeff_idx=0;;) {
This looks a bit unusual.
> if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) {
> /* parse a coeff */
> if (vp56_rac_get_prob(c, model2[2])) {
> @@ -483,8 +483,10 @@ static void vp6_parse_coeff(VP56Context *s)
> run += vp56_rac_get_prob(c, model3[i+8]) << i;
> }
> }
> -
> - cg = vp6_coeff_groups[coeff_idx+=run];
> + coeff_idx += run;
> + if (coeff_idx >= 64)
> + break;
> + cg = vp6_coeff_groups[coeff_idx];
> model1 = model2 = model->coeff_ract[pt][ct][cg];
> }
>
> --
Seems correct.
--
Måns Rullgård
[email protected]
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
