X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Frv40.c;h=dfeebda838111e607d5ba3b42dfe250e2b02cb40;hb=55eab1733b9e730ceac33edce9aab56c17ea87b2;hp=465011a079c317c4c4f60b621dd5df69daf99bd4;hpb=04b17ff9e819bde4c4fbcccf2b6d8d2781a798b0;p=ffmpeg

diff --git a/libavcodec/rv40.c b/libavcodec/rv40.c
index 465011a079c..dfeebda8381 100644
--- a/libavcodec/rv40.c
+++ b/libavcodec/rv40.c
@@ -109,6 +109,8 @@ static int get_dimension(GetBitContext *gb, const int *dim)
         val = dim[get_bits1(gb) - val];
     if(!val){
         do{
+            if (get_bits_left(gb) < 8)
+                return AVERROR_INVALIDDATA;
             t = get_bits(gb, 8);
             val += t << 2;
         }while(t == 0xFF);
@@ -187,7 +189,7 @@ static int rv40_decode_intra_types(RV34DecContext *r, GetBitContext *gb, int8_t
             A = ptr[-r->intra_types_stride + 1]; // it won't be used for the last coefficient in a row
             B = ptr[-r->intra_types_stride];
             C = ptr[-1];
-            pattern = A + (B << 4) + (C << 8);
+            pattern = A + B * (1 << 4) + C * (1 << 8);
             for(k = 0; k < MODE2_PATTERNS_NUM; k++)
                 if(pattern == rv40_aic_table_index[k])
                     break;