From 51ed1a7dd40aab921047c620a7a77c6a72863c91 Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Fri, 23 Dec 2016 09:41:06 +0100
Subject: [PATCH] avcodec/pixlet: check out of bounds pfx value

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/pixlet.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/pixlet.c b/libavcodec/pixlet.c
index c1bd32187b..359c4f3f6e 100644
--- a/libavcodec/pixlet.c
+++ b/libavcodec/pixlet.c
@@ -267,6 +267,8 @@ static int read_high_coeffs(AVCodecContext *avctx, uint8_t *src, int16_t *dst, i
         escape = av_mod_uintp2(16383, pfx);
         cnt1 = get_unary(b, 0, 8);
         if (cnt1 < 8) {
+            if (pfx < 1 || pfx > 25)
+                return AVERROR_INVALIDDATA;
             value = show_bits(b, pfx);
             if (value > 1) {
                 skip_bits(b, pfx);