Unified · Split
| @@ -84,6 +84,14 @@ static unsigned int apv_read_vlc(GetBitContext *gbc, int k_param, · 83 unmodified lines | ||
| 84 | 84 | next_bits = show_bits(gbc, 16); |
| 85 | 85 | leading_zeroes = 15 - av_log2(next_bits); |
| 86 | 86 | |
| 87 | + if (leading_zeroes == 0) { | |
| 88 | + // This can't happen mid-stream because the lookup would | |
| 89 | + // have resolved a leading one into a shorter code, but it | |
| 90 | + // can happen if we are hitting the end of the buffer. | |
| 91 | + // Return an invalid code to propagate as an error. | |
| 92 | + return APV_MAX_TRANS_COEFF + 1; | |
| 93 | + } | |
| 94 | + | |
| 87 | 95 | skip_bits(gbc, leading_zeroes + 1); |
| 88 | 96 | |
| 89 | 97 | return (2 << k_param) + |
| @@ -182,6 +190,14 @@ int ff_apv_entropy_decode_block(int16_t *coeff, · 92 unmodified lines | ||
| 182 | 190 | else |
| 183 | 191 | level = abs_ac_coeff_minus1 + 1; |
| 184 | 192 | |
| 193 | + if (level < APV_MIN_TRANS_COEFF || | |
| 194 | + level > APV_MAX_TRANS_COEFF) { | |
| 195 | + av_log(state->log_ctx, AV_LOG_ERROR, | |
| 196 | + "Out-of-range AC coefficient value: %d " | |
| 197 | + "(from prev_level %d abs_ac_coeff_minus1 %d sign_ac_coeff %d)\n", | |
| 198 | + level, prev_level, abs_ac_coeff_minus1, sign_ac_coeff); | |
| 199 | + } | |
| 200 | + | |
| 185 | 201 | coeff[ff_zigzag_direct[scan_pos]] = level; |
| 186 | 202 | |
| 187 | 203 | prev_level = abs_ac_coeff_minus1 + 1; |