projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
067432c
)
flicvideo: avoid an infinite loop in byte run compression
author
Anton Khirnov
<anton@khirnov.net>
Thu, 14 Feb 2013 11:40:36 +0000
(12:40 +0100)
committer
Anton Khirnov
<anton@khirnov.net>
Sat, 23 Feb 2013 08:22:30 +0000
(09:22 +0100)
When byte_run is 0, pixel_countdown is not touched and the loop will run
forever.
CC:libav-stable@libav.org
libavcodec/flicvideo.c
patch
|
blob
|
history
diff --git
a/libavcodec/flicvideo.c
b/libavcodec/flicvideo.c
index
f0b5d50
..
08c3ef3
100644
(file)
--- a/
libavcodec/flicvideo.c
+++ b/
libavcodec/flicvideo.c
@@
-348,6
+348,11
@@
static int flic_decode_frame_8BPP(AVCodecContext *avctx,
pixel_countdown = s->avctx->width;
while (pixel_countdown > 0) {
byte_run = sign_extend(bytestream2_get_byte(&g2), 8);
+ if (!byte_run) {
+ av_log(avctx, AV_LOG_ERROR, "Invalid byte run value.\n");
+ return AVERROR_INVALIDDATA;
+ }
+
if (byte_run > 0) {
palette_idx1 = bytestream2_get_byte(&g2);
CHECK_PIXEL_PTR(byte_run);