From c22b4468a6e87ccaf1630d83f12f6817f9e7eff7 Mon Sep 17 00:00:00 2001 From: Pascal Massimino Date: Sun, 1 Aug 2010 23:20:06 +0000 Subject: [PATCH] prevent access to vp8_coeff_band[16] Originally committed as revision 24656 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/vp8.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 1136f38a86..c82c36bca6 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -822,11 +822,11 @@ static int decode_block_coeffs(VP56RangeCoder *c, DCTELEM block[16], skip_eob: if (!vp56_rac_get_prob_branchy(c, token_prob[1])) { // DCT_0 + if (++i == 16) + return nonzero; // invalid input; blocks should end with EOB zero_nhood = 0; - token_prob = probs[vp8_coeff_band[++i]][0]; - if (i < 16) - goto skip_eob; - return nonzero; // invalid input; blocks should end with EOB + token_prob = probs[vp8_coeff_band[i]][0]; + goto skip_eob; } if (!vp56_rac_get_prob_branchy(c, token_prob[2])) { // DCT_1