check block_max_depth (fixes crash)

Originally committed as revision 4718 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/snow.c b/libavcodec/snow.c
index fb518315cc40bef4b730722b2a8c7e313cc72177..4207951ffac94d51cf6327404dde05eee7eb536f 100644 (file)
--- a/libavcodec/snow.c
+++ b/libavcodec/snow.c
@@ -3185,6 +3185,11 @@ static int decode_header(SnowContext *s){
     s->mv_scale= get_symbol(&s->c, s->header_state, 0);
     s->qbias= get_symbol(&s->c, s->header_state, 1);
     s->block_max_depth= get_symbol(&s->c, s->header_state, 0);
+    if(s->block_max_depth > 1){
+        av_log(s->avctx, AV_LOG_ERROR, "block_max_depth= %d is too large", s->block_max_depth);
+        s->block_max_depth= 0;
+        return -1;
+    }
 
     return 0;
 }