diff snow.c @ 3303:68721b62a528 libavcodec

sanity checks, some might have been exploitable ...
author michael
date Sat, 13 May 2006 10:45:26 +0000
parents c1add9fe5c65
children be941215e8e6
line wrap: on
line diff
--- a/snow.c	Thu May 11 23:17:23 2006 +0000
+++ b/snow.c	Sat May 13 10:45:26 2006 +0000
@@ -3712,7 +3712,7 @@
     s->mv_scale= get_symbol(&s->c, s->header_state, 0);
     s->qbias= get_symbol(&s->c, s->header_state, 1);
     s->block_max_depth= get_symbol(&s->c, s->header_state, 0);
-    if(s->block_max_depth > 1){
+    if(s->block_max_depth > 1 || s->block_max_depth < 0){
         av_log(s->avctx, AV_LOG_ERROR, "block_max_depth= %d is too large", s->block_max_depth);
         s->block_max_depth= 0;
         return -1;