eamad: check for out of bounds read
authorFederico Tomassetti <ftomassetti@groupon.com>
Wed, 18 Feb 2015 12:11:44 +0000 (12:11 +0000)
committerVittorio Giovara <vittorio.giovara@gmail.com>
Sun, 8 Mar 2015 19:41:12 +0000 (19:41 +0000)
Bug-Id: CID 1257500
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavcodec/eamad.c

index 405cc2a..72eae0f 100644 (file)
@@ -134,6 +134,11 @@ static inline void decode_block_intra(MadContext *s, DCTELEM * block)
                 break;
             } else if (level != 0) {
                 i += run;
+                if (i > 63) {
+                    av_log(s->avctx, AV_LOG_ERROR,
+                           "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
+                    return;
+                }
                 j = scantable[i];
                 level = (level*quant_matrix[j]) >> 4;
                 level = (level-1)|1;
@@ -148,6 +153,11 @@ static inline void decode_block_intra(MadContext *s, DCTELEM * block)
                 run = SHOW_UBITS(re, &s->gb, 6)+1; LAST_SKIP_BITS(re, &s->gb, 6);
 
                 i += run;
+                if (i > 63) {
+                    av_log(s->avctx, AV_LOG_ERROR,
+                           "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
+                    return;
+                }
                 j = scantable[i];
                 if (level < 0) {
                     level = -level;
@@ -159,10 +169,6 @@ static inline void decode_block_intra(MadContext *s, DCTELEM * block)
                     level = (level-1)|1;
                 }
             }
-            if (i > 63) {
-                av_log(s->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", s->mb_x, s->mb_y);
-                return;
-            }
 
             block[j] = level;
         }