Merge commit '5584abf69d83169a010aca404cd1cf95c23ad9ef'

[ffmpeg] / libavcodec / dirac_arith.h

diff --git a/libavcodec/dirac_arith.h b/libavcodec/dirac_arith.h
index 24a7ca390e704bec11e8f45435ff95b370f809b2..79526a7ca3c1928cdc0a167632060b6389204d85 100644 (file)
--- a/libavcodec/dirac_arith.h
+++ b/libavcodec/dirac_arith.h
@@ -81,6 +81,8 @@ typedef struct {
     const uint8_t *bytestream_end;
 
     uint16_t contexts[DIRAC_CTX_COUNT];
+    int error;
+    int overread;
 } DiracArith;
 
 extern const uint8_t ff_dirac_next_ctx[DIRAC_CTX_COUNT];
@@ -118,6 +120,9 @@ static inline void refill(DiracArith *c)
                 new |= 0xff00;
 
             c->bytestream = c->bytestream_end;
+            c->overread ++;
+            if (c->overread > 4)
+                c->error = AVERROR_INVALIDDATA;
         }
 
         c->low += new << counter;
@@ -173,6 +178,7 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
     while (!dirac_get_arith_bit(c, follow_ctx)) {
         if (ret >= 0x40000000) {
             av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+            c->error = AVERROR_INVALIDDATA;
             return -1;
         }
         ret <<= 1;