[FFmpeg-devel] [PATCH] lavc/golomb: Fix UE golomb overwrite issue.

[Jun Zhao]

From eabcbf3d41e83f24623e6195d4a0ff86e4d95a80 Mon Sep 17 00:00:00 2001
From: Jun Zhao <jun.zhao at intel.com>
Date: Fri, 26 May 2017 09:02:29 +0800
Subject: [PATCH] lavc/golomb: Fix UE golomb overwrite issue.

put_bits just support write up to 31 bits, when write 32 bit in
put_bits, it's will overwrite the bit buffer, because the default
assert level is 0, the av_assert2(n <= 31 && value < (1U << n))
in put_bits can not be trigger runtime.

Signed-off-by: Jun Zhao <jun.zhao at intel.com>
---
 libavcodec/golomb.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavcodec/golomb.h b/libavcodec/golomb.h
index 0833aff468..2c5a969ac1 100644
--- a/libavcodec/golomb.h
+++ b/libavcodec/golomb.h
@@ -468,7 +468,10 @@ static inline void set_ue_golomb(PutBitContext *pb, int i)
         put_bits(pb, ff_ue_golomb_len[i], i + 1);
     else {
         int e = av_log2(i + 1);
-        put_bits(pb, 2 * e + 1, i + 1);
+        if (e < 16)
+            put_bits(pb, 2 * e + 1, i + 1);
+        else
+            put_bits32(pb, i + 1);
     }
 }
 
-- 
2.11.0