avcodec/wmalosslessdec: Fix integer overflow with sliding in padding bits

[ffmpeg] / libavcodec / jpegtables.c

diff --git a/libavcodec/jpegtables.c b/libavcodec/jpegtables.c
index cbe5523cb43df4fad67790390095548fa6becee4..fa5c6f9fc58bba2e395d8b499b4b6679a894425d 100644 (file)
--- a/libavcodec/jpegtables.c
+++ b/libavcodec/jpegtables.c
@@ -130,14 +130,25 @@ void ff_mjpeg_build_huffman_codes(uint8_t *huff_size, uint16_t *huff_code,
 {
     int i, j, k,nb, code, sym;
 
-    code = 0;
+    /* Some badly encoded files [1] map 2 different codes to symbol 0.
+       Only the first one is valid, so we zero-initialize this here and
+       make sure we only set it once (the first time) in the loop below.
+
+       [1]: Embedded JPEGs in "X7 RAW" and "X7 CinemaDNG" samples here:
+            https://www.dji.com/gr/zenmuse-x7/info#downloads
+     */
+    huff_size[0] = 0;
+
     k = 0;
+    code = 0;
     for(i=1;i<=16;i++) {
         nb = bits_table[i];
         for(j=0;j<nb;j++) {
             sym = val_table[k++];
-            huff_size[sym] = i;
-            huff_code[sym] = code;
+            if (sym != 0 || huff_size[sym] == 0) { /* see comment above */
+                huff_size[sym] = i;
+                huff_code[sym] = code;
+            }
             code++;
         }
         code <<= 1;