[FFmpeg-cvslog] avcodec/webp: validate the distance prefix code

[Andreas Cadhalpun]

ffmpeg | branch: release/2.5 | Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com> | Mon Mar  2 20:47:57 2015 +0100| [1a2aaa74970c63a6cfa7fa966ea3a21e78618849] | committer: Michael Niedermayer

avcodec/webp: validate the distance prefix code

According to the WebP Lossless Bitstream Specification the highest
allowed value for a prefix code is 39.

If prefix_code is too large, the calculated extra_bits has an invalid
value and triggers an assertion in get_bits.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 5de2dab12b951b2fe121eb18503accfc91cd1565)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1a2aaa74970c63a6cfa7fa966ea3a21e78618849
---

 libavcodec/webp.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/webp.c b/libavcodec/webp.c
index 802b03c..f299550 100644
--- a/libavcodec/webp.c
+++ b/libavcodec/webp.c
@@ -694,6 +694,11 @@ static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
                 length = offset + get_bits(&s->gb, extra_bits) + 1;
             }
             prefix_code = huff_reader_get_symbol(&hg[HUFF_IDX_DIST], &s->gb);
+            if (prefix_code > 39) {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "distance prefix code too large: %d\n", prefix_code);
+                return AVERROR_INVALIDDATA;
+            }
             if (prefix_code < 4) {
                 distance = prefix_code + 1;
             } else {