cavsdec: check run value validity

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago · 961a1a81d8
parent 4ec8685435
commit 961a1a81d8
1 changed files with 2 additions and 0 deletions
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@ -125,6 +125,8 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
        level_code = get_ue_code(gb,r->golomb_order);
        if(level_code >= ESCAPE_CODE) {
            run = ((level_code - ESCAPE_CODE) >> 1) + 1;
+            if(run > 64)
+                return -1;
            esc_code = get_ue_code(gb,esc_golomb_order);
            level = esc_code + (run > r->max_run ? 1 : r->level_add[run]);
            while(level > r->inc_limit)