avcodec/dirac_arith: fix integer overflow
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 28 Oct 2014 01:14:41 +0000 (02:14 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 28 Oct 2014 14:00:05 +0000 (15:00 +0100)
Fixes: asan_heap-oob_1078676_9_008.drc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 39680caceebfc6abf09b17032048752c014e57a8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dirac_arith.h

index 089c71a..a1fa96b 100644 (file)
@@ -171,6 +171,10 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
 {
     int ret = 1;
     while (!dirac_get_arith_bit(c, follow_ctx)) {
+        if (ret >= 0x40000000) {
+            av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+            return -1;
+        }
         ret <<= 1;
         ret += dirac_get_arith_bit(c, data_ctx);
         follow_ctx = ff_dirac_next_ctx[follow_ctx];