1. ffmpeg
  2. Commit 8120a1d9bd4bcc4434b4f588f50c9d81aa8ad0e0
Browse code

qdm2dec: check remaining input bits in the mainloop of qdm2_fft_decode_tones() This is neccessary but likely not sufficient to prevent out of array reads.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 14db3af4f26dad8e6ddf2147e96ccc710952ad4d)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2011/11/19 01:56:24
Showing 1 changed files
libavcodec/qdm2.c
History View file @ 8120a1d
... ... 
@@ -1327,7 +1327,7 @@ static void qdm2_fft_decode_tones (QDM2Context *q, int duration, GetBitContext *
1327 1327 
     local_int_10 = 1 << (q->group_order - duration - 1);
1328 1328 
     offset = 1;
1329 1329
1330 
-    while (1) {
1330 
+    while (get_bits_left(gb)>0) {
1331 1331 
         if (q->superblocktype_2_3) {
1332 1332 
             while ((n = qdm2_get_vlc(gb, &vlc_tab_fft_tone_offset[local_int_8], 1, 2)) < 2) {
1333 1333 
                 offset = 1;