[1/2] smacker: add sanity check for length in smacker_decode_tree()
diff mbox

Message ID 1510107883-29628-1-git-send-email-gseanmcg@gmail.com
State New
Headers show

Commit Message

Sean McGovern Nov. 8, 2017, 2:24 a.m. 
From: Michael Niedermayer <michaelni@gmx.at>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
---
 libavcodec/smacker.c | 5 +++++
 1 file changed, 5 insertions(+)

Patch
diff mbox 

diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
index 0e057a1..e829405 100644
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -97,6 +97,11 @@  enum SmkBlockTypes {
 static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
                                uint32_t prefix, int length)
 {
+    if(length > 32) {
+        av_log(NULL, AV_LOG_ERROR, "length too long\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!bitstream_read_bit(bc)) { // Leaf
         if(hc->current >= 256){
             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");