X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdirac_arith.h;h=350a58fca6b44beacd49309372a0bafa721c635b;hb=eb6ea948ed2f86361ae0b9d8689368d466b8337f;hp=24a7ca390e704bec11e8f45435ff95b370f809b2;hpb=185aa5e896e15ae96145609944bfc6bbb239bc64;p=ffmpeg

diff --git a/libavcodec/dirac_arith.h b/libavcodec/dirac_arith.h
index 24a7ca390e7..350a58fca6b 100644
--- a/libavcodec/dirac_arith.h
+++ b/libavcodec/dirac_arith.h
@@ -81,10 +81,11 @@ typedef struct {
     const uint8_t *bytestream_end;
 
     uint16_t contexts[DIRAC_CTX_COUNT];
+    int error;
+    int overread;
 } DiracArith;
 
 extern const uint8_t ff_dirac_next_ctx[DIRAC_CTX_COUNT];
-extern const uint16_t ff_dirac_prob[256];
 extern int16_t ff_dirac_prob_branchless[256][2];
 
 static inline void renorm(DiracArith *c)
@@ -118,6 +119,9 @@ static inline void refill(DiracArith *c)
                 new |= 0xff00;
 
             c->bytestream = c->bytestream_end;
+            c->overread ++;
+            if (c->overread > 4)
+                c->error = AVERROR_INVALIDDATA;
         }
 
         c->low += new << counter;
@@ -173,6 +177,7 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
     while (!dirac_get_arith_bit(c, follow_ctx)) {
         if (ret >= 0x40000000) {
             av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+            c->error = AVERROR_INVALIDDATA;
             return -1;
         }
         ret <<= 1;