har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

smacker: Check for overread in smka_decode_frame()

Browse Source 
Fixes a segfault with wetlog_fail.smk
Bug found by: Shitiz Garg

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2011-12-15 22:45:57 +01:00
parent ffa1f541b3
commit d0f7927177
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/smacker.c
View File

@ -663,6 +663,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
for(i = 0; i <= stereo; i++) for(i = 0; i <= stereo; i++)
*samples++ = pred[i]; *samples++ = pred[i];
for(; i < unp_size / 2; i++) { for(; i < unp_size / 2; i++) {
if(get_bits_left(&gb)<0)
return -1;
if(i & stereo) { if(i & stereo) {
if(vlc[2].table) if(vlc[2].table)
res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3); res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@ -697,6 +699,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
for(i = 0; i <= stereo; i++) for(i = 0; i <= stereo; i++)
*samples8++ = pred[i]; *samples8++ = pred[i];
for(; i < unp_size; i++) { for(; i < unp_size; i++) {
if(get_bits_left(&gb)<0)
return -1;
if(i & stereo){ if(i & stereo){
if(vlc[1].table) if(vlc[1].table)
res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3); res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);