From 489c575bd6f8d5e6ac2e9106b7efa7e25a68f478 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 30 Oct 2013 14:23:30 +0100 Subject: [PATCH] avcodec/ivi_common: make while get_bits loop more robust by checking bits left Signed-off-by: Michael Niedermayer --- libavcodec/ivi_common.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index 4179852d7b6..ab4c9958c40 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -1042,7 +1042,12 @@ int ff_ivi_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, */ if (avctx->codec_id == AV_CODEC_ID_INDEO4 && ctx->frame_type == 0/*FRAMETYPE_INTRA*/) { - while (get_bits(&ctx->gb, 8)); // skip version string + // skip version string + while (get_bits(&ctx->gb, 8)) { + if (get_bits_left(&ctx->gb) < 8) + return AVERROR_INVALIDDATA; + } + skip_bits_long(&ctx->gb, 64); // skip padding, TODO: implement correct 8-bytes alignment if (get_bits_left(&ctx->gb) > 18 && show_bits(&ctx->gb, 18) == 0x3FFF8) av_log(avctx, AV_LOG_ERROR, "Buffer contains IP frames!\n"); -- 2.39.5