avcodec/rangecoder: Do not increase the pointer beyond the buffer
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 13 Aug 2017 22:15:54 +0000 (00:15 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 18 Aug 2017 09:33:14 +0000 (11:33 +0200)
Fixes: undefined behavior

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/rangecoder.c
libavcodec/rangecoder.h

index 0bb79c8..0d53bef 100644 (file)
@@ -58,6 +58,7 @@ av_cold void ff_init_range_decoder(RangeCoder *c, const uint8_t *buf,
 
     c->low         = AV_RB16(c->bytestream);
     c->bytestream += 2;
+    c->overread    = 0;
     if (c->low >= 0xFF00) {
         c->low = 0xFF00;
         c->bytestream_end = c->bytestream;
index c3e81d0..44af88b 100644 (file)
@@ -42,6 +42,8 @@ typedef struct RangeCoder {
     uint8_t *bytestream_start;
     uint8_t *bytestream;
     uint8_t *bytestream_end;
+    int overread;
+#define MAX_OVERREAD 2
 } RangeCoder;
 
 void ff_init_range_encoder(RangeCoder *c, uint8_t *buf, int buf_size);
@@ -106,9 +108,11 @@ static inline void refill(RangeCoder *c)
     if (c->range < 0x100) {
         c->range <<= 8;
         c->low   <<= 8;
-        if (c->bytestream < c->bytestream_end)
+        if (c->bytestream < c->bytestream_end) {
             c->low += c->bytestream[0];
-        c->bytestream++;
+            c->bytestream++;
+        } else
+            c->overread ++;
     }
 }