avcodec/jpeglsdec: check err value for ls_get_code_runterm()
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 30 Oct 2013 22:27:28 +0000 (23:27 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 21 Mar 2014 03:23:59 +0000 (04:23 +0100)
Fixes infinite loop
Fixes Ticket3086

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc0e47b55096361723b364afa43b79a3f5619cdc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/jpeglsdec.c

index 5e98b64..81b350c 100644 (file)
@@ -143,6 +143,8 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state, int RI
         ret = ret >> 1;
     }
 
+    if(FFABS(ret) > 0xFFFF)
+        return -0x10000;
     /* update state */
     state->A[Q] += FFABS(ret) - RItype;
     ret *= state->twonear;