On 5/15/2022 10:16 PM, Michael Niedermayer wrote:
Maybe helps coverity Helps: CID1433771 Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavcodec/mpeg4videodec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c index e2bde73639..715cb606c9 100644 --- a/libavcodec/mpeg4videodec.c +++ b/libavcodec/mpeg4videodec.c @@ -1981,7 +1981,8 @@ static int mpeg4_decode_studio_block(MpegEncContext *s, int32_t block[64], int n return AVERROR_INVALIDDATA; j = scantable[idx++]; block[j] = get_xbits(&s->gb, additional_code_len); - } else if (group == 21) { + } else { + av_assert2(group == 21);
Group is used as index to access two arrays with 22 elements each at the beginning of the while loop here. Maybe just also check for group > 21 and abort like we're doing for < 0, since it's clearly not a valid or expected value.
/* Escape */ if (idx > 63) return AVERROR_INVALIDDATA;
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".