wmalosslessdec: fix a get_bits(0) in decode_ac_filter

Fixes a part of CVE-2012-2795

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
pull/6/head
Michael Niedermayer 13 years ago committed by Anton Khirnov
parent 607f57152c
commit f48fbf2eb5
  1. 3
      libavcodec/wmalosslessdec.c

@ -406,7 +406,8 @@ static void decode_ac_filter(WmallDecodeCtx *s)
s->acfilter_scaling = get_bits(&s->gb, 4);
for (i = 0; i < s->acfilter_order; i++)
s->acfilter_coeffs[i] = get_bits(&s->gb, s->acfilter_scaling) + 1;
s->acfilter_coeffs[i] = (s->acfilter_scaling ?
get_bits(&s->gb, s->acfilter_scaling) : 0) + 1;
}
static void decode_mclms(WmallDecodeCtx *s)

Loading…
Cancel
Save