avcodec/alsdec: Fix integer overflow in decode_var_block_data()

[ffmpeg] / libavcodec / golomb.h

diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
index 5c25883626356ebe90018ca98274ebb7ab934073..5cdfa0945d35dc63ac8b79430cdfbed21abf9fca 100644 (file)
--- a/libavcodec/golomb.h
+++ b/libavcodec/golomb.h
@@ -49,6 +49,8 @@ extern const uint8_t ff_interleaved_dirac_golomb_vlc_code[256];
 
 /**
  * Read an unsigned Exp-Golomb code in the range 0 to 8190.
+ *
+ * @returns the read value or a negative error code.
  */
 static inline int get_ue_golomb(GetBitContext *gb)
 {
@@ -476,15 +478,19 @@ static inline int get_ur_golomb_jpegls(GetBitContext *gb, int k, int limit,
         return buf;
     } else {
         int i;
-        for (i = 0; i < limit && SHOW_UBITS(re, gb, 1) == 0; i++) {
+        for (i = 0; i + MIN_CACHE_BITS <= limit && SHOW_UBITS(re, gb, MIN_CACHE_BITS) == 0; i += MIN_CACHE_BITS) {
             if (gb->size_in_bits <= re_index) {
                 CLOSE_READER(re, gb);
                 return -1;
             }
-            LAST_SKIP_BITS(re, gb, 1);
+            LAST_SKIP_BITS(re, gb, MIN_CACHE_BITS);
             UPDATE_CACHE(re, gb);
         }
-        SKIP_BITS(re, gb, 1);
+        for (; i < limit && SHOW_UBITS(re, gb, 1) == 0; i++) {
+            SKIP_BITS(re, gb, 1);
+        }
+        LAST_SKIP_BITS(re, gb, 1);
+        UPDATE_CACHE(re, gb);
 
         if (i < limit - 1) {
             if (k) {