wmalosslessdec: fix a get_bits(0) in decode_ac_filter

Fixes a part of CVE-2012-2795

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Michael Niedermayer 2012-04-14 14:50:25 +02:00 committed by Anton Khirnov
parent 607f57152c
commit f48fbf2eb5

View File

@ -406,7 +406,8 @@ static void decode_ac_filter(WmallDecodeCtx *s)
s->acfilter_scaling = get_bits(&s->gb, 4);
for (i = 0; i < s->acfilter_order; i++)
s->acfilter_coeffs[i] = get_bits(&s->gb, s->acfilter_scaling) + 1;
s->acfilter_coeffs[i] = (s->acfilter_scaling ?
get_bits(&s->gb, s->acfilter_scaling) : 0) + 1;
}
static void decode_mclms(WmallDecodeCtx *s)