escape124: fix integer overflow leading to excessive memory allocation
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 16 Aug 2012 20:28:29 +0000 (22:28 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 16 Aug 2012 20:28:29 +0000 (22:28 +0200)
Fixes Ticket1629

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/escape124.c

index 12569c1..0ef16b5 100644 (file)
@@ -48,7 +48,7 @@ typedef struct Escape124Context {
     CodeBook codebooks[3];
 } Escape124Context;
 
-static int can_safely_read(GetBitContext* gb, int bits) {
+static int can_safely_read(GetBitContext* gb, uint64_t bits) {
     return get_bits_left(gb) >= bits;
 }
 
@@ -90,7 +90,7 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
     unsigned i, j;
     CodeBook cb = { 0 };
 
-    if (!can_safely_read(gb, size * 34))
+    if (!can_safely_read(gb, size * 34L))
         return cb;
 
     if (size >= INT_MAX / sizeof(MacroBlock))