On Fri, 2011-12-16 at 02:07 +0000, Måns Rullgård wrote:
> > re_bit_count is the bit offset within the uint32_t. It's never >31, also
> > not before the addition. So for re_bit_count < 31 and n any value, it
> > should mostly work.
> 
> 31 + INT_MAX overflows.
> 
> Do we trust callers of skip_bits_long() validate the length, e.g. when
> it is taken from the bitstream itself (perhaps to skip a length-prefixed
> block we don't care about)?

If the caller doesn't validate it and it can be INT_MAX then it can
likely also be negative. So if you want to handle that case then the
test should probably cast the value to an unsigned type.

_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to