projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
f48fbf2
)
wmalosslessdec: Fix reading too many bits in decode_channel_residues()
author
Anton Khirnov
<anton@khirnov.net>
Sat, 29 Sep 2012 17:16:32 +0000
(19:16 +0200)
committer
Anton Khirnov
<anton@khirnov.net>
Sat, 29 Sep 2012 17:16:32 +0000
(19:16 +0200)
Fixes a part of CVE-2012-2795
CC:libav-stable@libav.org
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
libavcodec/wmalosslessdec.c
patch
|
blob
|
history
diff --git
a/libavcodec/wmalosslessdec.c
b/libavcodec/wmalosslessdec.c
index
dc83b06
..
b97f397
100644
(file)
--- a/
libavcodec/wmalosslessdec.c
+++ b/
libavcodec/wmalosslessdec.c
@@
-520,7
+520,7
@@
static int decode_channel_residues(WmallDecodeCtx *s, int ch, int tile_size)
residue = quo;
else {
rem_bits = av_ceil_log2(ave_mean);
- rem = rem_bits ? get_bits(&s->gb, rem_bits) : 0;
+ rem = rem_bits ? get_bits
_long
(&s->gb, rem_bits) : 0;
residue = (quo << rem_bits) + rem;
}