On 5/15/2022 10:16 PM, Michael Niedermayer wrote:
Maybe helps coverity
Helps: CID1433771

Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc>
---
  libavcodec/mpeg4videodec.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
index e2bde73639..715cb606c9 100644
--- a/libavcodec/mpeg4videodec.c
+++ b/libavcodec/mpeg4videodec.c
@@ -1981,7 +1981,8 @@ static int mpeg4_decode_studio_block(MpegEncContext *s, 
int32_t block[64], int n
                  return AVERROR_INVALIDDATA;
              j = scantable[idx++];
              block[j] = get_xbits(&s->gb, additional_code_len);
-        } else if (group == 21) {
+        } else {
+            av_assert2(group == 21);

Group is used as index to access two arrays with 22 elements each at the beginning of the while loop here. Maybe just also check for group > 21 and abort like we're doing for < 0, since it's clearly not a valid or expected value.

              /* Escape */
              if (idx > 63)
                  return AVERROR_INVALIDDATA;
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

Reply via email to