Message ID | 5da14be177af2fd768c1cde4d450b27d659a5472.1631959242.git.pross@xvid.org |
---|---|
State | Accepted |
Commit | b007e8968f2072b9e8076d0ab474ad944fc07ade |
Headers | show |
Series | [FFmpeg-devel,1/3] avcodec/siren: prevent getbitcontext overread | expand |
Context | Check | Description |
---|---|---|
andriy/make_x86 | success | Make finished |
andriy/make_fate_x86 | success | Make fate finished |
andriy/make_ppc | success | Make finished |
andriy/make_fate_ppc | success | Make fate finished |
On Sat, Sep 18, 2021 at 08:01:38PM +1000, Peter Ross wrote: > --- > libavcodec/siren.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/libavcodec/siren.c b/libavcodec/siren.c > index 2161b29a2c..3b0ad7b642 100644 > --- a/libavcodec/siren.c > +++ b/libavcodec/siren.c > @@ -608,12 +608,16 @@ static int decode_vector(SirenContext *s, int number_of_regions, > > index >>= 1; > > - if (error == 0 && get_bits_left(gb) >= 0) { > + if (error == 0) { > for (j = 0; j < vector_dimension[category]; j++) { > decoded_value = mlt_quant[category][index & ((1 << index_table[category]) - 1)]; > index >>= index_table[category]; > > if (decoded_value) { > + if (get_bits_left(gb) <= 0) { > + error = 1; > + break; > + } > if (!get_bits1(gb)) > decoded_value *= -decoder_standard_deviation[region]; > else ping -- Peter (A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
On Sat, Sep 18, 2021 at 08:01:38PM +1000, Peter Ross wrote: > --- > libavcodec/siren.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) probably ok thx [...]
diff --git a/libavcodec/siren.c b/libavcodec/siren.c index 2161b29a2c..3b0ad7b642 100644 --- a/libavcodec/siren.c +++ b/libavcodec/siren.c @@ -608,12 +608,16 @@ static int decode_vector(SirenContext *s, int number_of_regions, index >>= 1; - if (error == 0 && get_bits_left(gb) >= 0) { + if (error == 0) { for (j = 0; j < vector_dimension[category]; j++) { decoded_value = mlt_quant[category][index & ((1 << index_table[category]) - 1)]; index >>= index_table[category]; if (decoded_value) { + if (get_bits_left(gb) <= 0) { + error = 1; + break; + } if (!get_bits1(gb)) decoded_value *= -decoder_standard_deviation[region]; else