Unified · Split
| @@ -84,6 +84,14 @@ static unsigned int apv_read_vlc(GetBitContext *gbc, int k_param, · 83 unmodified lines | |||
| 84 | next_bits = show_bits(gbc, 16); | 84 | next_bits = show_bits(gbc, 16); |
| 85 | leading_zeroes = 15 - av_log2(next_bits); | 85 | leading_zeroes = 15 - av_log2(next_bits); |
| 86 | 86 | ||
| 87 | if (leading_zeroes == 0) { | ||
| 88 | // This can't happen mid-stream because the lookup would | ||
| 89 | // have resolved a leading one into a shorter code, but it | ||
| 90 | // can happen if we are hitting the end of the buffer. | ||
| 91 | // Return an invalid code to propagate as an error. | ||
| 92 | return APV_MAX_TRANS_COEFF + 1; | ||
| 93 | } | ||
| 94 | |||
| 87 | skip_bits(gbc, leading_zeroes + 1); | 95 | skip_bits(gbc, leading_zeroes + 1); |
| 88 | 96 | ||
| 89 | return (2 << k_param) + | 97 | return (2 << k_param) + |
| @@ -182,6 +190,14 @@ int ff_apv_entropy_decode_block(int16_t *coeff, · 92 unmodified lines | |||
| 182 | else | 190 | else |
| 183 | level = abs_ac_coeff_minus1 + 1; | 191 | level = abs_ac_coeff_minus1 + 1; |
| 184 | 192 | ||
| 193 | if (level < APV_MIN_TRANS_COEFF || | ||
| 194 | level > APV_MAX_TRANS_COEFF) { | ||
| 195 | av_log(state->log_ctx, AV_LOG_ERROR, | ||
| 196 | "Out-of-range AC coefficient value: %d " | ||
| 197 | "(from prev_level %d abs_ac_coeff_minus1 %d sign_ac_coeff %d)\n", | ||
| 198 | level, prev_level, abs_ac_coeff_minus1, sign_ac_coeff); | ||
| 199 | } | ||
| 200 | |||
| 185 | coeff[ff_zigzag_direct[scan_pos]] = level; | 201 | coeff[ff_zigzag_direct[scan_pos]] = level; |
| 186 | 202 | ||
| 187 | prev_level = abs_ac_coeff_minus1 + 1; | 203 | prev_level = abs_ac_coeff_minus1 + 1; |