Add a check to vp6_parse_coeff_huffman to ensure it does not overread the input buffer.
authorReimar Döffinger <Reimar.Doeffinger@gmx.de>
Sun, 5 Jul 2009 16:01:51 +0000 (16:01 +0000)
committerReimar Döffinger <Reimar.Doeffinger@gmx.de>
Sun, 5 Jul 2009 16:01:51 +0000 (16:01 +0000)
Originally committed as revision 19349 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/vp6.c

index c1ca227..de98e61 100644 (file)
@@ -372,6 +372,8 @@ static void vp6_parse_coeff_huffman(VP56Context *s)
                 if (coeff_idx)
                     break;
             } else {
+                if (get_bits_count(&s->gb) >= s->gb.size_in_bits)
+                    return;
                 coeff = get_vlc2(&s->gb, vlc_coeff->table, 9, 3);
                 if (coeff == 0) {
                     if (coeff_idx) {