commit 1a6f024520d667a9fbf63e701cc029a6d556d76e
author Laurent Aimar <fenrir@elivagar.org> Sat Oct 01 00:43:05 2011 +0200
committer Michael Niedermayer <michaelni@gmx.at> Sun Nov 06 19:49:12 2011 +0100
tree 9c363880c6b63a0cc1bb8be2c41c7a7fced466fa
parent 3699a46ed7179601740a24bd9975abd2409ebf31

Prevent block size from inreasing in the shorten decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b399cbfba5d901608c18e1a2d48a24c30541a634)
(cherry picked from commit 55a96a984ec65736475a8577a158abc5c48fd50a)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/shorten.c

diff --git a/libavcodec/shorten.c b/libavcodec/shorten.c
index f8d2ff9..6aacd5c 100644
--- a/libavcodec/shorten.c
+++ b/libavcodec/shorten.c
@@ -469,9 +469,15 @@
             case FN_BITSHIFT:
                 s->bitshift = get_ur_golomb_shorten(&s->gb, BITSHIFTSIZE);
                 break;
-            case FN_BLOCKSIZE:
-                s->blocksize = get_uint(s, av_log2(s->blocksize));
+            case FN_BLOCKSIZE: {
+                int blocksize = get_uint(s, av_log2(s->blocksize));
+                if (blocksize > s->blocksize) {
+                    av_log(avctx, AV_LOG_ERROR, "Increasing block size is not supported\n");
+                    return AVERROR_PATCHWELCOME;
+                }
+                s->blocksize = blocksize;
                 break;
+            }
             case FN_QUIT:
                 *data_size = 0;
                 return buf_size;