Commit 3339bae2 authored by Andreas Cadhalpun's avatar Andreas Cadhalpun Committed by Michael Niedermayer

mpeg4videodec: only allow a positive length

Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3408ae4)

Conflicts:

	libavcodec/mpeg4videodec.c
parent 0b5405c4
...@@ -186,13 +186,13 @@ static int mpeg4_decode_sprite_trajectory(MpegEncContext *s, GetBitContext *gb) ...@@ -186,13 +186,13 @@ static int mpeg4_decode_sprite_trajectory(MpegEncContext *s, GetBitContext *gb)
int x=0, y=0; int x=0, y=0;
length= get_vlc2(gb, sprite_trajectory.table, SPRITE_TRAJ_VLC_BITS, 3); length= get_vlc2(gb, sprite_trajectory.table, SPRITE_TRAJ_VLC_BITS, 3);
if(length){ if(length > 0){
x= get_xbits(gb, length); x= get_xbits(gb, length);
} }
if(!(s->divx_version==500 && s->divx_build==413)) skip_bits1(gb); /* marker bit */ if(!(s->divx_version==500 && s->divx_build==413)) skip_bits1(gb); /* marker bit */
length= get_vlc2(gb, sprite_trajectory.table, SPRITE_TRAJ_VLC_BITS, 3); length= get_vlc2(gb, sprite_trajectory.table, SPRITE_TRAJ_VLC_BITS, 3);
if(length){ if(length > 0){
y=get_xbits(gb, length); y=get_xbits(gb, length);
} }
skip_bits1(gb); /* marker bit */ skip_bits1(gb); /* marker bit */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment