Merge commit '3c2717e48dd8c5115f2be35c2afcabd8a1f67aee'

[ffmpeg] / libavcodec / lagarith.c

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 469eec42327c8fffc964b58f87a508f3e2375a07..1f4afc5312015bb204041d0c6bcb38a2e597e84a 100644 (file)
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -98,7 +98,7 @@ static uint32_t softfloat_mul(uint32_t x, uint64_t mantissa)
 
 static uint8_t lag_calc_zero_run(int8_t x)
 {
-    return (x << 1) ^ (x >> 7);
+    return (x * 2) ^ (x >> 7);
 }
 
 static int lag_decode_prob(GetBitContext *gb, uint32_t *value)
@@ -191,7 +191,9 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
         }
 
         scale_factor++;
-        cumulative_target = 1 << scale_factor;
+        if (scale_factor >= 32U)
+            return AVERROR_INVALIDDATA;
+        cumulative_target = 1U << scale_factor;
 
         if (scaled_cumul_prob > cumulative_target) {
             av_log(rac->avctx, AV_LOG_ERROR,