Skip to content
Permalink
Browse files Browse the repository at this point in the history
smacker: add sanity check for length in smacker_decode_tree()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
  • Loading branch information
michaelni authored and SeanMcG committed Nov 11, 2017
1 parent 17b6c7e commit cd4663d
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion libavcodec/smacker.c
Expand Up @@ -43,7 +43,7 @@

#define SMKTREE_BITS 9
#define SMK_NODE 0x80000000

#define SMKTREE_DECODE_MAX_RECURSION 32

typedef struct SmackVContext {
AVCodecContext *avctx;
Expand Down Expand Up @@ -97,6 +97,11 @@ enum SmkBlockTypes {
static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
uint32_t prefix, int length)
{
if (length > SMKTREE_DECODE_MAX_RECURSION) {
av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
return AVERROR_INVALIDDATA;
}

if (!bitstream_read_bit(bc)) { // Leaf
if(hc->current >= 256){
av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
Expand Down

0 comments on commit cd4663d

Please sign in to comment.