Skip to content

Commit cd4663d

Browse files
michaelniSeanMcG
authored andcommitted
smacker: add sanity check for length in smacker_decode_tree()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Bug-Id: 1098 Cc: libav-stable@libav.org Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
1 parent 17b6c7e commit cd4663d

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

Diff for: libavcodec/smacker.c

+6-1
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343

4444
#define SMKTREE_BITS 9
4545
#define SMK_NODE 0x80000000
46-
46+
#define SMKTREE_DECODE_MAX_RECURSION 32
4747

4848
typedef struct SmackVContext {
4949
AVCodecContext *avctx;
@@ -97,6 +97,11 @@ enum SmkBlockTypes {
9797
static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
9898
uint32_t prefix, int length)
9999
{
100+
if (length > SMKTREE_DECODE_MAX_RECURSION) {
101+
av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
102+
return AVERROR_INVALIDDATA;
103+
}
104+
100105
if (!bitstream_read_bit(bc)) { // Leaf
101106
if(hc->current >= 256){
102107
av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");

0 commit comments

Comments
 (0)