From: Federico Tomassetti <[email protected]>
Bug-Id: CID 1257501
CC: [email protected]
---
libavcodec/mdec.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/libavcodec/mdec.c b/libavcodec/mdec.c
index 6b70e37..2a1dbe3 100644
--- a/libavcodec/mdec.c
+++ b/libavcodec/mdec.c
@@ -86,7 +86,11 @@ static inline int mdec_decode_block_intra(MDECContext *a,
int16_t *block, int n)
if (level == 127) {
break;
} else if (level != 0) {
- i += run;
+ i += run;
+ if (i > 63) {
+ av_log(a->avctx, AV_LOG_ERROR, "ac-tex damaged at %d
%d\n", a->mb_x, a->mb_y);
+ return AVERROR_INVALIDDATA;
+ }
j = scantable[i];
level = (level * qscale * quant_matrix[j]) >> 3;
level = (level ^ SHOW_SBITS(re, &a->gb, 1)) - SHOW_SBITS(re,
&a->gb, 1);
@@ -96,8 +100,12 @@ static inline int mdec_decode_block_intra(MDECContext *a,
int16_t *block, int n)
run = SHOW_UBITS(re, &a->gb, 6)+1; LAST_SKIP_BITS(re, &a->gb,
6);
UPDATE_CACHE(re, &a->gb);
level = SHOW_SBITS(re, &a->gb, 10); SKIP_BITS(re, &a->gb, 10);
- i += run;
- j = scantable[i];
+ i += run;
+ if (i > 63) {
+ av_log(a->avctx, AV_LOG_ERROR, "ac-tex damaged at %d
%d\n", a->mb_x, a->mb_y);
+ return AVERROR_INVALIDDATA;
+ }
+ j = scantable[i];
if (level < 0) {
level = -level;
level = (level * qscale * quant_matrix[j]) >> 3;
@@ -108,10 +116,6 @@ static inline int mdec_decode_block_intra(MDECContext *a,
int16_t *block, int n)
level = (level - 1) | 1;
}
}
- if (i > 63) {
- av_log(a->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n",
a->mb_x, a->mb_y);
- return AVERROR_INVALIDDATA;
- }
block[j] = level;
}
--
2.2.2
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
