avcodec/h261dec: make while get_bits loop more robust by checking bits left
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 30 Oct 2013 13:23:30 +0000 (14:23 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 30 Oct 2013 13:45:39 +0000 (14:45 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/h261dec.c

index 5e45fc7..2995d8c 100644 (file)
@@ -125,8 +125,11 @@ static int h261_decode_gob_header(H261Context *h)
     }
 
     /* GEI */
-    while (get_bits1(&s->gb) != 0)
+    while (get_bits1(&s->gb) != 0) {
         skip_bits(&s->gb, 8);
+        if (get_bits_left(&s->gb) <= 0)
+            return AVERROR_INVALIDDATA;
+    }
 
     if (s->qscale == 0) {
         av_log(s->avctx, AV_LOG_ERROR, "qscale has forbidden 0 value\n");
@@ -505,8 +508,11 @@ static int h261_decode_picture_header(H261Context *h)
     skip_bits1(&s->gb); /* Reserved */
 
     /* PEI */
-    while (get_bits1(&s->gb) != 0)
+    while (get_bits1(&s->gb) != 0) {
         skip_bits(&s->gb, 8);
+        if (get_bits_left(&s->gb) <= 0)
+            return AVERROR_INVALIDDATA;
+    }
 
     /* H.261 has no I-frames, but if we pass AV_PICTURE_TYPE_I for the first
      * frame, the codec crashes if it does not contain all I-blocks