From d11fcddf175ae8e7d69fd3ef3504a104f6545087 Mon Sep 17 00:00:00 2001 From: Rainbaby Date: Fri, 28 Aug 2026 16:18:08 +0900 Subject: [PATCH] avcodec/cavsdec: reject the error returns of get_ue_golomb() get_ue_golomb() returns AVERROR_INVALIDDATA on thirteen or more leading zero bits. Two callers used the value unchecked: mb_type reached decode_mb_p() with a value no case of its switch covers, leaving ff_cavs_inter() and ff_cavs_filter() to index ff_cavs_partition_flags[] with it, and mb_skip_run was decremented from negative. decode_mb_b() already rejects the first, so do it the same way. Only the unsigned underlying type of enum cavs_mb hid the first under gcc and clang; that is a compiler's choice, not a guarantee. Signed-off-by: Rainbaby --- libavcodec/cavsdec.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index cd35491192..2e503a77aa 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -780,6 +780,11 @@ static int decode_mb_p(AVSContext *h, enum cavs_mb mb_type) ff_cavs_mv(h, MV_FWD_X1, MV_FWD_C2, MV_PRED_MEDIAN, BLK_8X8, ref[1]); ff_cavs_mv(h, MV_FWD_X2, MV_FWD_X1, MV_PRED_MEDIAN, BLK_8X8, ref[2]); ff_cavs_mv(h, MV_FWD_X3, MV_FWD_X0, MV_PRED_MEDIAN, BLK_8X8, ref[3]); + break; + default: + av_log(h->avctx, AV_LOG_ERROR, "Invalid mb_type %d in P frame\n", + mb_type); + return AVERROR_INVALIDDATA; } ff_cavs_inter(h, mb_type); set_intra_mode_default(h); @@ -1162,6 +1167,10 @@ static int decode_pic(AVSContext *h) break; } skip_count = get_ue_golomb(&h->gb); + if (skip_count < 0) { + ret = AVERROR_INVALIDDATA; + break; + } } if (h->skip_mode_flag && skip_count--) { ret = decode_mb_p(h, P_SKIP); @@ -1199,6 +1208,10 @@ static int decode_pic(AVSContext *h) break; } skip_count = get_ue_golomb(&h->gb); + if (skip_count < 0) { + ret = AVERROR_INVALIDDATA; + break; + } } if (h->skip_mode_flag && skip_count--) { ret = decode_mb_b(h, B_SKIP);