OSDN Git Service
(root)
/
android-x86
/
external-ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
5145d22
)
avcodec/dirac_arith: fix integer overflow
author
Michael Niedermayer
<michaelni@gmx.at>
Tue, 28 Oct 2014 01:14:41 +0000
(
02:14
+0100)
committer
Michael Niedermayer
<michaelni@gmx.at>
Tue, 28 Oct 2014 01:15:40 +0000
(
02:15
+0100)
Fixes: asan_heap-oob_1078676_9_008.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dirac_arith.h
patch
|
blob
|
history
diff --git
a/libavcodec/dirac_arith.h
b/libavcodec/dirac_arith.h
index
089c71a
..
a1fa96b
100644
(file)
--- a/
libavcodec/dirac_arith.h
+++ b/
libavcodec/dirac_arith.h
@@
-171,6
+171,10
@@
static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
{
int ret = 1;
while (!dirac_get_arith_bit(c, follow_ctx)) {
+ if (ret >= 0x40000000) {
+ av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+ return -1;
+ }
ret <<= 1;
ret += dirac_get_arith_bit(c, data_ctx);
follow_ctx = ff_dirac_next_ctx[follow_ctx];