avcodec/escape124: fix infinite loop

Remove can_safely_read() as its not really needed with
checked bitstream reader.

Fixes #2984.
Reported-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Paul B Mahol <onemda@gmail.com>
pull/36/head
Paul B Mahol 11 years ago
parent ca10d66719
commit e494f44c05
  1. 18
      libavcodec/escape124.c

@ -49,10 +49,6 @@ typedef struct Escape124Context {
CodeBook codebooks[3]; CodeBook codebooks[3];
} Escape124Context; } Escape124Context;
static int can_safely_read(GetBitContext* gb, uint64_t bits) {
return get_bits_left(gb) >= bits;
}
/** /**
* Initialize the decoder * Initialize the decoder
* @param avctx decoder context * @param avctx decoder context
@ -90,7 +86,7 @@ static CodeBook unpack_codebook(GetBitContext* gb, unsigned depth,
unsigned i, j; unsigned i, j;
CodeBook cb = { 0 }; CodeBook cb = { 0 };
if (!can_safely_read(gb, (uint64_t)size * 34)) if (size >= INT_MAX / 34 || get_bits_left(gb) < size * 34)
return cb; return cb;
if (size >= INT_MAX / sizeof(MacroBlock)) if (size >= INT_MAX / sizeof(MacroBlock))
@ -121,7 +117,7 @@ static unsigned decode_skip_count(GetBitContext* gb)
unsigned value; unsigned value;
// This function reads a maximum of 23 bits, // This function reads a maximum of 23 bits,
// which is within the padding space // which is within the padding space
if (!can_safely_read(gb, 1)) if (get_bits_left(gb) < 1)
return -1; return -1;
value = get_bits1(gb); value = get_bits1(gb);
if (!value) if (!value)
@ -222,7 +218,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
// This call also guards the potential depth reads for the // This call also guards the potential depth reads for the
// codebook unpacking. // codebook unpacking.
if (!can_safely_read(&gb, 64)) if (get_bits_left(&gb) < 64)
return -1; return -1;
frame_flags = get_bits_long(&gb, 32); frame_flags = get_bits_long(&gb, 32);
@ -298,7 +294,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
copy_superblock(sb.pixels, 8, copy_superblock(sb.pixels, 8,
old_frame_data, old_stride); old_frame_data, old_stride);
while (can_safely_read(&gb, 1) && !get_bits1(&gb)) { while (get_bits_left(&gb) >= 1 && !get_bits1(&gb)) {
unsigned mask; unsigned mask;
mb = decode_macroblock(s, &gb, &cb_index, superblock_index); mb = decode_macroblock(s, &gb, &cb_index, superblock_index);
mask = get_bits(&gb, 16); mask = get_bits(&gb, 16);
@ -310,7 +306,7 @@ static int escape124_decode_frame(AVCodecContext *avctx,
} }
} }
if (can_safely_read(&gb, 1) && !get_bits1(&gb)) { if (!get_bits1(&gb)) {
unsigned inv_mask = get_bits(&gb, 4); unsigned inv_mask = get_bits(&gb, 4);
for (i = 0; i < 4; i++) { for (i = 0; i < 4; i++) {
if (inv_mask & (1 << i)) { if (inv_mask & (1 << i)) {
@ -322,15 +318,13 @@ static int escape124_decode_frame(AVCodecContext *avctx,
for (i = 0; i < 16; i++) { for (i = 0; i < 16; i++) {
if (multi_mask & mask_matrix[i]) { if (multi_mask & mask_matrix[i]) {
if (!can_safely_read(&gb, 1))
break;
mb = decode_macroblock(s, &gb, &cb_index, mb = decode_macroblock(s, &gb, &cb_index,
superblock_index); superblock_index);
insert_mb_into_sb(&sb, mb, i); insert_mb_into_sb(&sb, mb, i);
} }
} }
} else if (frame_flags & (1 << 16)) { } else if (frame_flags & (1 << 16)) {
while (can_safely_read(&gb, 1) && !get_bits1(&gb)) { while (get_bits_left(&gb) >= 1 && !get_bits1(&gb)) {
mb = decode_macroblock(s, &gb, &cb_index, superblock_index); mb = decode_macroblock(s, &gb, &cb_index, superblock_index);
insert_mb_into_sb(&sb, mb, get_bits(&gb, 4)); insert_mb_into_sb(&sb, mb, get_bits(&gb, 4));
} }

Loading…
Cancel
Save