mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/on2avc: Check run more carefully
Fixes CID1239106 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
93cfa7d169
commit
22f15f5735
|
@ -119,12 +119,12 @@ static int on2avc_decode_band_types(On2AVCContext *c, GetBitContext *gb)
|
||||||
run_len = 1;
|
run_len = 1;
|
||||||
do {
|
do {
|
||||||
run = get_bits(gb, bits_per_sect);
|
run = get_bits(gb, bits_per_sect);
|
||||||
|
if (run > num_bands - band - run_len) {
|
||||||
|
av_log(c->avctx, AV_LOG_ERROR, "Invalid band type run\n");
|
||||||
|
return AVERROR_INVALIDDATA;
|
||||||
|
}
|
||||||
run_len += run;
|
run_len += run;
|
||||||
} while (run == esc_val);
|
} while (run == esc_val);
|
||||||
if (band + run_len > num_bands) {
|
|
||||||
av_log(c->avctx, AV_LOG_ERROR, "Invalid band type run\n");
|
|
||||||
return AVERROR_INVALIDDATA;
|
|
||||||
}
|
|
||||||
for (i = band; i < band + run_len; i++) {
|
for (i = band; i < band + run_len; i++) {
|
||||||
c->band_type[i] = band_type;
|
c->band_type[i] = band_type;
|
||||||
c->band_run_end[i] = band + run_len;
|
c->band_run_end[i] = band + run_len;
|
||||||
|
|
Loading…
Reference in New Issue