[FFmpeg-devel] [PATCH] vp6_parse_coeff_huffman misses buffer size check

[Reimar Döffinger]

Hello,
affected file is vp62/smclockvp62hsp.avi.1.1 from issue 1240.
One solution is just to check if there is still data available for every
coded coefficient. Given the overall complexity of the code that might
even be acceptable, no idea.
Probably vp6_parse_coeff needs the same kind of check, but I don't have
a sample file to test.
Anyway, that is the change I did (an additional av_log probably wouldn't
hurt):
Index: libavcodec/vp6.c
===================================================================
--- libavcodec/vp6.c    (revision 19346)
+++ libavcodec/vp6.c    (working copy)
@@ -372,6 +372,8 @@
                 if (coeff_idx)
                     break;
             } else {
+                if (get_bits_count(&s->gb) >= s->gb.size_in_bits)
+                    return;
                 coeff = get_vlc2(&s->gb, vlc_coeff->table, 9, 3);
                 if (coeff == 0) {
                     if (coeff_idx) {