[FFmpeg-cvslog] avcodec/h261dec: make while get_bits loop more robust by checking bits left

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Oct 30 14:23:30 2013 +0100| [719dbe86ea0e85b3b89f492c69e10bb0e733bcbb] | committer: Michael Niedermayer

avcodec/h261dec: make while get_bits loop more robust by checking bits left

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=719dbe86ea0e85b3b89f492c69e10bb0e733bcbb
---

 libavcodec/h261dec.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/libavcodec/h261dec.c b/libavcodec/h261dec.c
index 5e45fc7..2995d8c 100644
--- a/libavcodec/h261dec.c
+++ b/libavcodec/h261dec.c
@@ -125,8 +125,11 @@ static int h261_decode_gob_header(H261Context *h)
     }
 
     /* GEI */
-    while (get_bits1(&s->gb) != 0)
+    while (get_bits1(&s->gb) != 0) {
         skip_bits(&s->gb, 8);
+        if (get_bits_left(&s->gb) <= 0)
+            return AVERROR_INVALIDDATA;
+    }
 
     if (s->qscale == 0) {
         av_log(s->avctx, AV_LOG_ERROR, "qscale has forbidden 0 value\n");
@@ -505,8 +508,11 @@ static int h261_decode_picture_header(H261Context *h)
     skip_bits1(&s->gb); /* Reserved */
 
     /* PEI */
-    while (get_bits1(&s->gb) != 0)
+    while (get_bits1(&s->gb) != 0) {
         skip_bits(&s->gb, 8);
+        if (get_bits_left(&s->gb) <= 0)
+            return AVERROR_INVALIDDATA;
+    }
 
     /* H.261 has no I-frames, but if we pass AV_PICTURE_TYPE_I for the first
      * frame, the codec crashes if it does not contain all I-blocks