diff options
author | Ronald S. Bultje | 2012-02-14 11:50:57 -0800 |
---|---|---|
committer | Ronald S. Bultje | 2012-02-16 08:36:08 -0800 |
commit | c6643fddba73560f26f90d327c84d8832222a720 (patch) | |
tree | 09f7a58cde29e7943d4baa199f2b57ceee7efb41 /libavcodec/golomb.h | |
parent | c9fdf3241a96f01496facea9249b3965fa2df653 (diff) |
golomb: avoid infinite loop on all-zero input (or end of buffer).
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/golomb.h')
-rw-r--r-- | libavcodec/golomb.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h index 503aa1416a..e19064c642 100644 --- a/libavcodec/golomb.h +++ b/libavcodec/golomb.h @@ -123,7 +123,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ }else{ int ret = 1; - while (1) { + do { buf >>= 32 - 8; LAST_SKIP_BITS(re, gb, FFMIN(ff_interleaved_golomb_vlc_len[buf], 8)); @@ -135,7 +135,7 @@ static inline int svq3_get_ue_golomb(GetBitContext *gb){ ret = (ret << 4) | ff_interleaved_dirac_golomb_vlc_code[buf]; UPDATE_CACHE(re, gb); buf = GET_CACHE(re, gb); - } + } while (ret); CLOSE_READER(re, gb); return ret - 1; |