[Ffmpeg-cvslog] r5746 - trunk/libavcodec/cavs.c

[stefang]

Author: stefang
Date: Fri Jul 14 20:38:23 2006
New Revision: 5746

Modified:
   trunk/libavcodec/cavs.c

Log:
avoid overflows of qp and pic_type


Modified: trunk/libavcodec/cavs.c
==============================================================================
--- trunk/libavcodec/cavs.c	(original)
+++ trunk/libavcodec/cavs.c	Fri Jul 14 20:38:23 2006
@@ -716,7 +716,7 @@
 
     /* get quantizer */
     if(h->cbp && !h->qp_fixed)
-        h->qp += get_se_golomb(&h->s.gb);
+        h->qp = (h->qp + get_se_golomb(&h->s.gb)) & 63;
     for(block=0;block<4;block++)
         if(h->cbp & (1<<block))
             decode_residual_block(h,&h->s.gb,inter_2dvlc,0,h->qp,
@@ -876,7 +876,7 @@
     }
     h->cbp = cbp_tab[cbp_code][0];
     if(h->cbp && !h->qp_fixed)
-        h->qp += get_se_golomb(gb); //qp_delta
+        h->qp = (h->qp + get_se_golomb(gb)) & 63; //qp_delta
 
     /* luma intra prediction interleaved with residual decode/transform/add */
     for(block=0;block<4;block++) {
@@ -1154,6 +1154,10 @@
     get_bits(&s->gb,16);//bbv_dwlay
     if(h->stc == PIC_PB_START_CODE) {
         h->pic_type = get_bits(&s->gb,2) + FF_I_TYPE;
+        if(h->pic_type > FF_B_TYPE) {
+            av_log(s->avctx, AV_LOG_ERROR, "illegal picture type\n");
+            return -1;
+        }
         /* make sure we have the reference frames we need */
         if(!h->DPB[0].data[0] ||
           (!h->DPB[1].data[0] && h->pic_type == FF_B_TYPE))