ffmpeg | branch: master | Andreas Rheinhardt <andreas.rheinha...@gmail.com> | Fri Jul 10 15:12:26 2020 +0200| [69636b443c4f40286135ad9658b5d44a9de4f3a4] | committer: Andreas Rheinhardt
avcodec/golomb: Prevent shift by negative number This happened in get_ue_golomb() if the cached bitstream reader was in use, because there was no check to handle the case of the read value not being in the supported range. For consistency with the uncached bitstream reader and for compliance with the documentation, every value not in the 0-8190 range is treated as error although the cached bitstream reader could actually read values in the range 0..65534 without problems. Reviewed-by: Michael Niedermayer <mich...@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@gmail.com> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=69636b443c4f40286135ad9658b5d44a9de4f3a4 --- libavcodec/golomb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h index 1f988d74aa..aed9b22471 100644 --- a/libavcodec/golomb.h +++ b/libavcodec/golomb.h @@ -66,9 +66,12 @@ static inline int get_ue_golomb(GetBitContext *gb) return ff_ue_golomb_vlc_code[buf]; } else { int log = 2 * av_log2(buf) - 31; + + skip_bits_long(gb, 32 - log); + if (log < 7) + return AVERROR_INVALIDDATA; buf >>= log; buf--; - skip_bits_long(gb, 32 - log); return buf; } _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog To unsubscribe, visit link above, or email ffmpeg-cvslog-requ...@ffmpeg.org with subject "unsubscribe".
