vp3dec: Check coefficient index in vp3_dequant()
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 18 Nov 2011 17:08:31 +0000 (18:08 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 21 Nov 2011 17:31:23 +0000 (18:31 +0100)
Fixes NGS00145

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eef5c35b4352ec49ca41f6198bee8a976b1f81e5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vp3.c

index 549f494..2f07af8 100644 (file)
@@ -1308,6 +1308,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
+            if(i>63){
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return -1;
+            }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
             break;