|
|
|
@ -565,8 +565,10 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb, |
|
|
|
|
level_code = get_ue_code(gb, r->golomb_order); |
|
|
|
|
if (level_code >= ESCAPE_CODE) { |
|
|
|
|
run = ((level_code - ESCAPE_CODE) >> 1) + 1; |
|
|
|
|
if(run > 64) |
|
|
|
|
if(run > 64) { |
|
|
|
|
av_log(h->avctx, AV_LOG_ERROR, "run %d is too large\n", run); |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
} |
|
|
|
|
esc_code = get_ue_code(gb, esc_golomb_order); |
|
|
|
|
level = esc_code + (run > r->max_run ? 1 : r->level_add[run]); |
|
|
|
|
while (level > r->inc_limit) |
|
|
|
@ -892,8 +894,10 @@ static inline int decode_slice_header(AVSContext *h, GetBitContext *gb) |
|
|
|
|
if (h->stc > 0xAF) |
|
|
|
|
av_log(h->avctx, AV_LOG_ERROR, "unexpected start code 0x%02x\n", h->stc); |
|
|
|
|
|
|
|
|
|
if (h->stc >= h->mb_height) |
|
|
|
|
if (h->stc >= h->mb_height) { |
|
|
|
|
av_log(h->avctx, AV_LOG_ERROR, "stc 0x%02x is too large\n", h->stc); |
|
|
|
|
return AVERROR_INVALIDDATA; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
h->mby = h->stc; |
|
|
|
|
h->mbidx = h->mby * h->mb_width; |
|
|
|
|