[FFmpeg-cvslog] smacker: Check for overread in smka_decode_frame()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Dec 15 22:45:57 2011 +0100| [d0f7927177077799abe540f9195b5ce1fc089183] | committer: Michael Niedermayer

smacker: Check for overread in smka_decode_frame()
Fixes a segfault with wetlog_fail.smk
Bug found by: Shitiz Garg

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d0f7927177077799abe540f9195b5ce1fc089183
---

 libavcodec/smacker.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
index a983922..fdc28e1 100644
--- a/libavcodec/smacker.c
+++ b/libavcodec/smacker.c
@@ -663,6 +663,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
         for(i = 0; i <= stereo; i++)
             *samples++ = pred[i];
         for(; i < unp_size / 2; i++) {
+            if(get_bits_left(&gb)<0)
+                return -1;
             if(i & stereo) {
                 if(vlc[2].table)
                     res = get_vlc2(&gb, vlc[2].table, SMKTREE_BITS, 3);
@@ -697,6 +699,8 @@ static int smka_decode_frame(AVCodecContext *avctx, void *data,
         for(i = 0; i <= stereo; i++)
             *samples8++ = pred[i];
         for(; i < unp_size; i++) {
+            if(get_bits_left(&gb)<0)
+                return -1;
             if(i & stereo){
                 if(vlc[1].table)
                     res = get_vlc2(&gb, vlc[1].table, SMKTREE_BITS, 3);