mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2025-02-13 18:19:35 +00:00
avcodec/dirac_arith: fix integer overflow
Fixes: asan_heap-oob_1078676_9_008.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 39680cacee
)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
8e95ddbe82
commit
3f3e5f8f60
@ -171,6 +171,10 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
|
||||
{
|
||||
int ret = 1;
|
||||
while (!dirac_get_arith_bit(c, follow_ctx)) {
|
||||
if (ret >= 0x40000000) {
|
||||
av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
|
||||
return -1;
|
||||
}
|
||||
ret <<= 1;
|
||||
ret += dirac_get_arith_bit(c, data_ctx);
|
||||
follow_ctx = ff_dirac_next_ctx[follow_ctx];
|
||||
|
Loading…
Reference in New Issue
Block a user