smacker: add sanity check for length in smacker_decode_tree()
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 21 Jun 2012 14:01:52 +0000 (16:01 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 21 Jun 2012 17:49:37 +0000 (19:49 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/smacker.c

index c177510..0179420 100644 (file)
@@ -96,6 +96,10 @@ enum SmkBlockTypes {
  */
 static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length)
 {
+    if(length > 32) {
+        av_log(NULL, AV_LOG_ERROR, "length too long\n");
+        return -1;
+    }
     if(!get_bits1(gb)){ //Leaf
         if(hc->current >= 256){
             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");