avcodec/jpeglsdec: check err value for ls_get_code_runterm()
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 30 Oct 2013 22:27:28 +0000 (23:27 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 8 Mar 2014 15:25:20 +0000 (16:25 +0100)
Fixes infinite loop
Fixes Ticket3086

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit cc0e47b55096361723b364afa43b79a3f5619cdc)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/jpeglsdec.c

index 879922a..417bb40 100644 (file)
@@ -142,6 +142,8 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state, int RI
         ret = ret >> 1;
     }
 
         ret = ret >> 1;
     }
 
+    if(FFABS(ret) > 0xFFFF)
+        return -0x10000;
     /* update state */
     state->A[Q] += FFABS(ret) - RItype;
     ret *= state->twonear;
     /* update state */
     state->A[Q] += FFABS(ret) - RItype;
     ret *= state->twonear;