[FFmpeg-cvslog] avcodec/pixlet: check out of bounds pfx value

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Fri Dec 23 09:41:06 2016 +0100| [51ed1a7dd40aab921047c620a7a77c6a72863c91] | committer: Paul B Mahol

avcodec/pixlet: check out of bounds pfx value

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=51ed1a7dd40aab921047c620a7a77c6a72863c91
---

 libavcodec/pixlet.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/pixlet.c b/libavcodec/pixlet.c
index c1bd321..359c4f3 100644
--- a/libavcodec/pixlet.c
+++ b/libavcodec/pixlet.c
@@ -267,6 +267,8 @@ static int read_high_coeffs(AVCodecContext *avctx, uint8_t *src, int16_t *dst, i
         escape = av_mod_uintp2(16383, pfx);
         cnt1 = get_unary(b, 0, 8);
         if (cnt1 < 8) {
+            if (pfx < 1 || pfx > 25)
+                return AVERROR_INVALIDDATA;
             value = show_bits(b, pfx);
             if (value > 1) {
                 skip_bits(b, pfx);