From cc0e47b55096361723b364afa43b79a3f5619cdc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Wed, 30 Oct 2013 23:27:28 +0100
Subject: avcodec/jpeglsdec: check err value for ls_get_code_runterm()

Fixes infinite loop
Fixes Ticket3086

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/jpeglsdec.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'libavcodec/jpeglsdec.c')

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index 0e344f5..1dda207 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -148,6 +148,8 @@ static inline int ls_get_code_runterm(GetBitContext *gb, JLSState *state,
         ret = ret >> 1;
     }
 
+    if(FFABS(ret) > 0xFFFF)
+        return -0x10000;
     /* update state */
     state->A[Q] += FFABS(ret) - RItype;
     ret         *= state->twonear;
-- 
cgit v1.1