RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

smacker: Check get_vlc() return values. 

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-04-16 16:39:02 +02:00
parent 8e77c3846e
commit 71d3c25a7e
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/smacker.c
View File

@ -672,11 +672,19 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
else
res = 0;
if (res < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid vlc\n");
return AVERROR_INVALIDDATA;
}
val = h[2].values[res];
if(vlc[3].table)
res = get_vlc2(&gb, vlc[3].table, SMKTREE_BITS, 3);
else
res = 0;
if (res < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid vlc\n");
return AVERROR_INVALIDDATA;
}
val |= h[3].values[res] << 8;
pred[1] += sign_extend(val, 16);
*samples++ = av_clip_int16(pred[1]);
@ -685,11 +693,19 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
res = get_vlc2(&gb, vlc[0].table, SMKTREE_BITS, 3);
else
res = 0;
if (res < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid vlc\n");
return AVERROR_INVALIDDATA;
}
val = h[0].values[res];
if(vlc[1].table)
res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);
else
res = 0;
if (res < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid vlc\n");
return AVERROR_INVALIDDATA;
}
val |= h[1].values[res] << 8;
pred[0] += sign_extend(val, 16);
*samples++ = av_clip_int16(pred[0]);
@ -708,6 +724,10 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);
else
res = 0;
if (res < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid vlc\n");
return AVERROR_INVALIDDATA;
}
pred[1] += sign_extend(h[1].values[res], 8);
*samples8++ = av_clip_uint8(pred[1]);
} else {
@ -715,6 +735,10 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
res = get_vlc2(&gb, vlc[0].table, SMKTREE_BITS, 3);
else
res = 0;
if (res < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid vlc\n");
return AVERROR_INVALIDDATA;
}
pred[0] += sign_extend(h[0].values[res], 8);
*samples8++ = av_clip_uint8(pred[0]);
}