golomb: avoid infinite loop on all-zero input (or end of buffer).
authorRonald S. Bultje <rsbultje@gmail.com>
Tue, 14 Feb 2012 19:50:57 +0000 (11:50 -0800)
committerRonald S. Bultje <rsbultje@gmail.com>
Thu, 16 Feb 2012 16:36:08 +0000 (08:36 -0800)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavcodec/golomb.h

index 503aa14..e19064c 100644 (file)
@@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
     }else{
         int ret = 1;
 
-        while (1) {
+        do {
             buf >>= 32 - 8;
             LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8));
 
@@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){
             ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf];
             UPDATE_CACHE(re, gb);
             buf = GET_CACHE(re, gb);
-        }
+        } while (ret);
 
         CLOSE_READER(re, gb);
         return ret - 1;