From 961a1a81d88a05afabb895f8a9dd11e789a07d89 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 11 Aug 2011 19:55:44 +0200 Subject: [PATCH] cavsdec: check run value validity Signed-off-by: Michael Niedermayer --- libavcodec/cavsdec.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 7beedb81b7..fcfe06e2ce 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -125,6 +125,8 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb, level_code = get_ue_code(gb,r->golomb_order); if(level_code >= ESCAPE_CODE) { run = ((level_code - ESCAPE_CODE) >> 1) + 1; + if(run > 64) + return -1; esc_code = get_ue_code(gb,esc_golomb_order); level = esc_code + (run > r->max_run ? 1 : r->level_add[run]); while(level > r->inc_limit)