shorten: check for return value

Message ID 20141113004711.022605DFC5@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau Nov. 13, 2014, 12:47 a.m.
Module: libav
Branch: master
Commit: 8e104619a627fcf5f4c2bd3c09d0c2d323aae745

Author:    Vittorio Giovara <vittorio.giovara@gmail.com>
Committer: Vittorio Giovara <vittorio.giovara@gmail.com>
Date:      Tue Nov 11 17:40:08 2014 +0100

shorten: check for return value

Avoid a possible negative bitshift.

CC: libav-stable@libav.org
Bug-Id: CID 1194400

---

 libavcodec/shorten.c |    2 ++
 1 file changed, 2 insertions(+)

Patch

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index c465fff..c93ba6b 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -510,6 +510,8 @@  static int shorten_decode_frame(AVCodecContext *avctx, void *data,
                 break;
             case FN_BITSHIFT:
                 s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
+                if (s->bitshift < 0)
+                    return AVERROR_INVALIDDATA;
                 break;
             case FN_BLOCKSIZE: {
                 unsigned blocksize = get_uint(s, av_log2(s->blocksize));