[FFmpeg-cvslog] avcodec/indeo5: Fix infinite loop in skip_hdr_extension()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Jun 15 03:17:11 2014 +0200| [103f9c261a68299125b99c542e20f5541051d2c9] | committer: Michael Niedermayer

avcodec/indeo5: Fix infinite loop in skip_hdr_extension()

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=103f9c261a68299125b99c542e20f5541051d2c9
---

 libavcodec/indeo5.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c
index a556fc7..75f79ad 100644
--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -289,14 +289,18 @@ static int decode_gop_header(IVI45DecContext *ctx, AVCodecContext *avctx)
  *
  *  @param[in,out]  gb  the GetBit context
  */
-static inline void skip_hdr_extension(GetBitContext *gb)
+static inline int skip_hdr_extension(GetBitContext *gb)
 {
     int i, len;
 
     do {
         len = get_bits(gb, 8);
+        if (8*len > get_bits_left(gb))
+            return AVERROR_INVALIDDATA;
         for (i = 0; i < len; i++) skip_bits(gb, 8);
     } while(len);
+
+    return 0;
 }