mirror of https://git.ffmpeg.org/ffmpeg.git
tm2: check for invalid vlcs, fix out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
c6945228e8
commit
31fce39942
|
@ -200,6 +200,8 @@ static inline int tm2_get_token(GetBitContext *gb, TM2Codes *code)
|
||||||
{
|
{
|
||||||
int val;
|
int val;
|
||||||
val = get_vlc2(gb, code->vlc.table, code->bits, 1);
|
val = get_vlc2(gb, code->vlc.table, code->bits, 1);
|
||||||
|
if(val<0)
|
||||||
|
return -1;
|
||||||
return code->recode[val];
|
return code->recode[val];
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -325,7 +327,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
|
||||||
return AVERROR_INVALIDDATA;
|
return AVERROR_INVALIDDATA;
|
||||||
}
|
}
|
||||||
ctx->tokens[stream_id][i] = tm2_get_token(&ctx->gb, &codes);
|
ctx->tokens[stream_id][i] = tm2_get_token(&ctx->gb, &codes);
|
||||||
if (stream_id <= TM2_MOT && ctx->tokens[stream_id][i] >= TM2_DELTAS) {
|
if (stream_id <= TM2_MOT && ctx->tokens[stream_id][i] >= TM2_DELTAS || ctx->tokens[stream_id][i]<0) {
|
||||||
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
|
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
|
||||||
ctx->tokens[stream_id][i], stream_id, i);
|
ctx->tokens[stream_id][i], stream_id, i);
|
||||||
return AVERROR_INVALIDDATA;
|
return AVERROR_INVALIDDATA;
|
||||||
|
|
Loading…
Reference in New Issue