avcodec/dirac_arith: fix integer overflow

Fixes: asan_heap-oob_1078676_9_008.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 39680cacee)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-10-28 02:14:41 +01:00
parent 8e95ddbe82
commit 3f3e5f8f60

View File

@ -171,6 +171,10 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
{
int ret = 1;
while (!dirac_get_arith_bit(c, follow_ctx)) {
if (ret >= 0x40000000) {
av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
return -1;
}
ret <<= 1;
ret += dirac_get_arith_bit(c, data_ctx);
follow_ctx = ff_dirac_next_ctx[follow_ctx];