diff options
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cavsdec.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 9450ed137f..fa60d6c0eb 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -510,11 +510,15 @@ static inline void mv_pred_sym(AVSContext *h, cavs_vector *src, /** kth-order exponential golomb code */ static inline int get_ue_code(GetBitContext *gb, int order) { + unsigned ret = get_ue_golomb(gb); + if (ret >= ((1U<<31)>>order)) { + av_log(NULL, AV_LOG_ERROR, "get_ue_code: value too larger\n"); + return AVERROR_INVALIDDATA; + } if (order) { - int ret = get_ue_golomb(gb) << order; - return ret + get_bits(gb, order); + return (ret<<order) + get_bits(gb, order); } - return get_ue_golomb(gb); + return ret; } static inline int dequant(AVSContext *h, int16_t *level_buf, uint8_t *run_buf, |