smacker: Check for overread in smka_decode_frame()
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 15 Dec 2011 21:45:57 +0000 (22:45 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Jan 2012 17:26:09 +0000 (18:26 +0100)
Fixes a segfault with wetlog_fail.smk
Bug found by: Shitiz Garg

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d0f7927177077799abe540f9195b5ce1fc089183)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/smacker.c

index a983922..fdc28e1 100644 (file)
@@ -663,6 +663,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
         for(i = 0; i <= stereo; i++)
             *samples++ = pred[i];
         for(; i < unp_size / 2; i++) {
+            if(get_bits_left(&gb)<0)
+                return -1;
             if(i & stereo) {
                 if(vlc[2].table)
                     res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@@ -697,6 +699,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
         for(i = 0; i <= stereo; i++)
             *samples8++ = pred[i];
         for(; i < unp_size; i++) {
+            if(get_bits_left(&gb)<0)
+                return -1;
             if(i & stereo){
                 if(vlc[1].table)
                     res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);