From 030c7f0309ec0e3cadb990408b4bb9b7fd739425 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 10 Jan 2016 16:59:42 +0100 Subject: avcodec/g2meet: Check for ff_els_decode_bit() failure in epic_decode_run_length() Fixes invalid shift Fixes: g2m_left_shift_2.wmv Found-by: Piotr Bandurski Signed-off-by: Michael Niedermayer --- libavcodec/g2meet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'libavcodec/g2meet.c') diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index 2815704997..51e8bbcd7b 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -631,6 +631,8 @@ static int epic_decode_run_length(ePICContext *dc, int x, int y, int tile_width, (NN != N) << 1 | (NNW != NW); WWneW = ff_els_decode_bit(&dc->els_ctx, &dc->W_ctx_rung[idx]); + if (WWneW < 0) + return WWneW; } if (WWneW) @@ -837,10 +839,13 @@ static int epic_decode_tile(ePICContext *dc, uint8_t *out, int tile_height, if (y < 2 || x < 2 || x == tile_width - 1) { run = 1; got_pixel = epic_handle_edges(dc, x, y, curr_row, above_row, &pix); - } else + } else { got_pixel = epic_decode_run_length(dc, x, y, tile_width, curr_row, above_row, above2_row, &pix, &run); + if (got_pixel < 0) + return got_pixel; + } if (!got_pixel && !epic_predict_from_NW_NE(dc, x, y, run, tile_width, curr_row, -- cgit v1.2.3