Browse code

vp5: Fix illegal read.

Found with Address Sanitizer
(cherry picked from commit bb4b0ad83b13c3af57675e80163f3f333adef96f)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Alex Converse authored on 2011/11/18 03:06:14
Showing 1 changed files
... ...
@@ -183,7 +183,8 @@ static void vp5_parse_coeff(VP56Context *s)
183 183
         model1 = model->coeff_dccv[pt];
184 184
         model2 = model->coeff_dcct[pt][ctx];
185 185
 
186
-        for (coeff_idx=0; coeff_idx<64; ) {
186
+        coeff_idx = 0;
187
+        for (;;) {
187 188
             if (vp56_rac_get_prob(c, model2[0])) {
188 189
                 if (vp56_rac_get_prob(c, model2[2])) {
189 190
                     if (vp56_rac_get_prob(c, model2[3])) {
... ...
@@ -220,8 +221,11 @@ static void vp5_parse_coeff(VP56Context *s)
220 220
                 ct = 0;
221 221
                 s->coeff_ctx[vp56_b6to4[b]][coeff_idx] = 0;
222 222
             }
223
+            coeff_idx++;
224
+            if (coeff_idx >= 64)
225
+                break;
223 226
 
224
-            cg = vp5_coeff_groups[++coeff_idx];
227
+            cg = vp5_coeff_groups[coeff_idx];
225 228
             ctx = s->coeff_ctx[vp56_b6to4[b]][coeff_idx];
226 229
             model1 = model->coeff_ract[pt][ct][cg];
227 230
             model2 = cg > 2 ? model1 : model->coeff_acct[pt][ct][cg][ctx];