X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fdirac_arith.h;h=79526a7ca3c1928cdc0a167632060b6389204d85;hb=b2f32d60eeaf883bb7d9e1b8cc2fb9a983d08f72;hp=24a7ca390e704bec11e8f45435ff95b370f809b2;hpb=22219a3ac46ac18f797c94e4619a34728556786c;p=ffmpeg

diff --git a/libavcodec/dirac_arith.h b/libavcodec/dirac_arith.h
index 24a7ca390e7..79526a7ca3c 100644
--- a/libavcodec/dirac_arith.h
+++ b/libavcodec/dirac_arith.h
@@ -81,6 +81,8 @@ typedef struct {
     const uint8_t *bytestream_end;
 
     uint16_t contexts[DIRAC_CTX_COUNT];
+    int error;
+    int overread;
 } DiracArith;
 
 extern const uint8_t ff_dirac_next_ctx[DIRAC_CTX_COUNT];
@@ -118,6 +120,9 @@ static inline void refill(DiracArith *c)
                 new |= 0xff00;
 
             c->bytestream = c->bytestream_end;
+            c->overread ++;
+            if (c->overread > 4)
+                c->error = AVERROR_INVALIDDATA;
         }
 
         c->low += new << counter;
@@ -173,6 +178,7 @@ static inline int dirac_get_arith_uint(DiracArith *c, int follow_ctx, int data_c
     while (!dirac_get_arith_bit(c, follow_ctx)) {
         if (ret >= 0x40000000) {
             av_log(NULL, AV_LOG_ERROR, "dirac_get_arith_uint overflow\n");
+            c->error = AVERROR_INVALIDDATA;
             return -1;
         }
         ret <<= 1;