Browse code

check all svq3_get_ue_golomb() returns.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 979bea13003ef489d95d2538ac2fb1c26c6f103b)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2011/09/18 04:53:21
Showing 3 changed files
... ...
@@ -79,7 +79,7 @@ static int rv30_decode_intra_types(RV34DecContext *r, GetBitContext *gb, int8_t
79 79
     for(i = 0; i < 4; i++, dst += r->s.b4_stride - 4){
80 80
         for(j = 0; j < 4; j+= 2){
81 81
             int code = svq3_get_ue_golomb(gb) << 1;
82
-            if(code >= 81*2){
82
+            if(code >= 81U*2U){
83 83
                 av_log(r->s.avctx, AV_LOG_ERROR, "Incorrect intra prediction code\n");
84 84
                 return -1;
85 85
             }
... ...
@@ -108,7 +108,7 @@ static int rv30_decode_mb_info(RV34DecContext *r)
108 108
     GetBitContext *gb = &s->gb;
109 109
     int code = svq3_get_ue_golomb(gb);
110 110
 
111
-    if(code > 11){
111
+    if(code > 11U){
112 112
         av_log(s->avctx, AV_LOG_ERROR, "Incorrect MB type code\n");
113 113
         return -1;
114 114
     }
... ...
@@ -207,8 +207,11 @@ static int rv40_decode_mb_info(RV34DecContext *r)
207 207
     int blocks[RV34_MB_TYPES] = {0};
208 208
     int count = 0;
209 209
 
210
-    if(!r->s.mb_skip_run)
210
+    if(!r->s.mb_skip_run) {
211 211
         r->s.mb_skip_run = svq3_get_ue_golomb(gb) + 1;
212
+        if(r->s.mb_skip_run > (unsigned)s->mb_num)
213
+            return -1;
214
+    }
212 215
 
213 216
     if(--r->s.mb_skip_run)
214 217
          return RV34_MB_SKIP;
... ...
@@ -202,7 +202,7 @@ static inline int svq3_decode_block(GetBitContext *gb, DCTELEM *block,
202 202
     for (limit = (16 >> intra); index < 16; index = limit, limit += 8) {
203 203
         for (; (vlc = svq3_get_ue_golomb(gb)) != 0; index++) {
204 204
 
205
-          if (vlc == INVALID_VLC)
205
+          if (vlc < 0)
206 206
               return -1;
207 207
 
208 208
           sign = (vlc & 0x1) - 1;
... ...
@@ -220,7 +220,7 @@ static inline int svq3_decode_block(GetBitContext *gb, DCTELEM *block,
220 220
                   level = ((vlc + 9) >> 2) - run;
221 221
               }
222 222
           } else {
223
-              if (vlc < 16) {
223
+              if (vlc < 16U) {
224 224
                   run   = svq3_dct_tables[intra][vlc].run;
225 225
                   level = svq3_dct_tables[intra][vlc].level;
226 226
               } else if (intra) {
... ...
@@ -549,7 +549,7 @@ static int svq3_decode_mb(H264Context *h, unsigned int mb_type)
549 549
             for (i = 0; i < 16; i+=2) {
550 550
                 vlc = svq3_get_ue_golomb(&s->gb);
551 551
 
552
-                if (vlc >= 25){
552
+                if (vlc >= 25U){
553 553
                     av_log(h->s.avctx, AV_LOG_ERROR, "luma prediction:%d\n", vlc);
554 554
                     return -1;
555 555
                 }
... ...
@@ -620,7 +620,7 @@ static int svq3_decode_mb(H264Context *h, unsigned int mb_type)
620 620
     }
621 621
 
622 622
     if (!IS_INTRA16x16(mb_type) && (!IS_SKIP(mb_type) || s->pict_type == FF_B_TYPE)) {
623
-        if ((vlc = svq3_get_ue_golomb(&s->gb)) >= 48){
623
+        if ((vlc = svq3_get_ue_golomb(&s->gb)) >= 48U){
624 624
             av_log(h->s.avctx, AV_LOG_ERROR, "cbp_vlc=%d\n", vlc);
625 625
             return -1;
626 626
         }
... ...
@@ -630,7 +630,7 @@ static int svq3_decode_mb(H264Context *h, unsigned int mb_type)
630 630
     if (IS_INTRA16x16(mb_type) || (s->pict_type != FF_I_TYPE && s->adaptive_quant && cbp)) {
631 631
         s->qscale += svq3_get_se_golomb(&s->gb);
632 632
 
633
-        if (s->qscale > 31){
633
+        if (s->qscale > 31U){
634 634
             av_log(h->s.avctx, AV_LOG_ERROR, "qscale:%d\n", s->qscale);
635 635
             return -1;
636 636
         }
... ...
@@ -727,7 +727,7 @@ static int svq3_decode_slice_header(H264Context *h)
727 727
         skip_bits_long(&s->gb, 0);
728 728
     }
729 729
 
730
-    if ((i = svq3_get_ue_golomb(&s->gb)) == INVALID_VLC || i >= 3){
730
+    if ((i = svq3_get_ue_golomb(&s->gb)) >= 3U){
731 731
         av_log(h->s.avctx, AV_LOG_ERROR, "illegal slice type %d \n", i);
732 732
         return -1;
733 733
     }