[FFmpeg-cvslog] r19348 - trunk/libavcodec/vp56.h

[aurel]

Author: aurel
Date: Sun Jul  5 17:23:42 2009
New Revision: 19348

Log:
vp56dec: ensure range coder won't read past the end of input buffer

Modified:
   trunk/libavcodec/vp56.h

Modified: trunk/libavcodec/vp56.h
==============================================================================
--- trunk/libavcodec/vp56.h	Sun Jul  5 14:14:05 2009	(r19347)
+++ trunk/libavcodec/vp56.h	Sun Jul  5 17:23:42 2009	(r19348)
@@ -50,6 +50,7 @@ typedef struct {
     int high;
     int bits;
     const uint8_t *buffer;
+    const uint8_t *end;
     unsigned long code_word;
 } VP56RangeCoder;
 
@@ -185,6 +186,7 @@ static inline void vp56_init_range_decod
     c->high = 255;
     c->bits = 8;
     c->buffer = buf;
+    c->end = buf + buf_size;
     c->code_word = bytestream_get_be16(&c->buffer);
 }
 
@@ -205,7 +207,7 @@ static inline int vp56_rac_get_prob(VP56
     while (c->high < 128) {
         c->high <<= 1;
         c->code_word <<= 1;
-        if (--c->bits == 0) {
+        if (--c->bits == 0 && c->buffer < c->end) {
             c->bits = 8;
             c->code_word |= *c->buffer++;
         }
@@ -228,7 +230,7 @@ static inline int vp56_rac_get(VP56Range
 
     /* normalize */
     c->code_word <<= 1;
-    if (--c->bits == 0) {
+    if (--c->bits == 0 && c->buffer < c->end) {
         c->bits = 8;
         c->code_word |= *c->buffer++;
     }