Mercurial > libavcodec.hg

comparison cavsdec.c @ 6913:e716466d3665 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Arrays where one element too small, fixes CID114. this was possibly exploitable
author michael
date Tue, 27 May 2008 22:10:17 +0000
parents a4104482ceef
children e943e1409077
comparison
equal deleted inserted replaced
6912:941a4e753961 6913:e716466d3665
114 */ 114 */
115 static int decode_residual_block(AVSContext *h, GetBitContext *gb, 115 static int decode_residual_block(AVSContext *h, GetBitContext *gb,
116 const dec_2dvlc_t *r, int esc_golomb_order, 116 const dec_2dvlc_t *r, int esc_golomb_order,
117 int qp, uint8_t *dst, int stride) { 117 int qp, uint8_t *dst, int stride) {
118 int i, level_code, esc_code, level, run, mask; 118 int i, level_code, esc_code, level, run, mask;
119 DCTELEM level_buf[64]; 119 DCTELEM level_buf[65];
120 uint8_t run_buf[64]; 120 uint8_t run_buf[65];
121 DCTELEM *block = h->block; 121 DCTELEM *block = h->block;
122 122
123 for(i=0;i<65;i++) { 123 for(i=0;i<65;i++) {
124 level_code = get_ue_code(gb,r->golomb_order); 124 level_code = get_ue_code(gb,r->golomb_order);
125 if(level_code >= ESCAPE_CODE) { 125 if(level_code >= ESCAPE_CODE) {