Merge commit '2383323661f3b8342b2c4d356fcfe8c5d1b045f8'

[ffmpeg] / libavcodec / dirac_arith.h

diff --git a/libavcodec/dirac_arith.h b/libavcodec/dirac_arith.h
index 089c71a69830ff54ad550ffda3f19586d959c475..a1fa96b5bca3b0b77f06821aea07056e13ec06af 100644 (file)
--- a/libavcodec/dirac_arith.h
+++ b/libavcodec/dirac_arith.h
@@ -171,6 +171,10 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
 {
     int ret = 1;
     while (!dirac_get_arith_bit(c, follow_ctx)) {
+        if (ret >= 0x40000000) {
+            av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+            return -1;
+        }
         ret <<= 1;
         ret += dirac_get_arith_bit(c, data_ctx);
         follow_ctx = ff_dirac_next_ctx[follow_ctx];