[FFmpeg-cvslog] h264_cavlc: fix assertion failure due to reading too long vlc

Michael Niedermayer git at videolan.org
Thu Jan 16 02:46:59 CET 2014


ffmpeg | branch: release/1.2 | Michael Niedermayer <michaelni at gmx.at> | Thu Mar 28 03:16:01 2013 +0100| [47faf347a0ed7c8a28232fa07ad0a53edccad7ac] | committer: Michael Niedermayer

h264_cavlc: fix assertion failure due to reading too long vlc

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 10ece44d0948b44b062d09319052d09d14f7bfdb)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=47faf347a0ed7c8a28232fa07ad0a53edccad7ac
---

 libavcodec/h264_cavlc.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c
index 089d41a..1e979e5 100644
--- a/libavcodec/h264_cavlc.c
+++ b/libavcodec/h264_cavlc.c
@@ -549,9 +549,15 @@ static int decode_residual(H264Context *h, GetBitContext *gb, int16_t *block, in
                 if(prefix<15){
                     level_code = (prefix<<suffix_length) + get_bits(gb, suffix_length);
                 }else{
-                    level_code = (15<<suffix_length) + get_bits(gb, prefix-3);
-                    if(prefix>=16)
+                    level_code = 15<<suffix_length;
+                    if (prefix>=16) {
+                        if(prefix > 25+3){
+                            av_log(h->avctx, AV_LOG_ERROR, "Invalid level prefix\n");
+                            return AVERROR_INVALIDDATA;
+                        }
                         level_code += (1<<(prefix-3))-4096;
+                    }
+                    level_code += get_bits(gb, prefix-3);
                 }
                 mask= -(level_code&1);
                 level_code= (((2+level_code)>>1) ^ mask) - mask;



More information about the ffmpeg-cvslog mailing list