diff options
| author | Rostislav Pehlivanov <atomnuker@gmail.com> | 2016-07-13 23:53:05 +0100 |
|---|---|---|
| committer | Rostislav Pehlivanov <atomnuker@gmail.com> | 2016-07-13 23:53:05 +0100 |
| commit | 000eb01a7d14ee635bd0e554ea92e05feb8cf685 (patch) | |
| tree | dfef30df73566e26b48d826f045183c732322f86 /libavcodec/diracdec.c | |
| parent | b2b12b2d4ab1347e06770bfb4ea1bdf1b1c70527 (diff) | |
| download | ffmpeg-streaming-000eb01a7d14ee635bd0e554ea92e05feb8cf685.zip ffmpeg-streaming-000eb01a7d14ee635bd0e554ea92e05feb8cf685.tar.gz | |
diracdec: fix unchecked byte length
Also drops the start variable since it's redundant.
Found by Coverity, fixes CID1363964
Signed-off-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Diffstat (limited to 'libavcodec/diracdec.c')
| -rw-r--r-- | libavcodec/diracdec.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index dc42a42..6cb098b 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -835,11 +835,10 @@ static int decode_hq_slice(DiracContext *s, DiracSlice *slice, uint8_t *tmp_buf) for (i = 0; i < 3; i++) { int coef_num, coef_par, off = 0; int64_t length = s->highquality.size_scaler*get_bits(gb, 8); - int64_t start = get_bits_count(gb); - int64_t bits_end = start + 8*length; + int64_t bits_end = get_bits_count(gb) + 8*length; const uint8_t *addr = align_get_bits(gb); - if (bits_end >= INT_MAX) { + if (length*8 > get_bits_left(gb)) { av_log(s->avctx, AV_LOG_ERROR, "end too far away\n"); return AVERROR_INVALIDDATA; } |
