It causes a cb_depth of 32, leading to assertion failures in get_bits.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
// This codebook can be cut off at places other than
// powers of 2, leaving some of the entries undefined.
cb_size = get_bits_long(&gb, 20);
// This codebook can be cut off at places other than
// powers of 2, leaving some of the entries undefined.
cb_size = get_bits_long(&gb, 20);
+ if (!cb_size) {
+ av_log(avctx, AV_LOG_ERROR, "Invalid codebook size 0.\n");
+ return AVERROR_INVALIDDATA;
+ }
cb_depth = av_log2(cb_size - 1) + 1;
} else {
cb_depth = get_bits(&gb, 4);
cb_depth = av_log2(cb_size - 1) + 1;
} else {
cb_depth = get_bits(&gb, 4);