Commit 86c35629 authored by François Cartegnie's avatar François Cartegnie 🤞

vlc_bits: add shift guard on bs_read

and reject any reads > 32
parent 3eaa1607
......@@ -96,9 +96,15 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
0x1fffff, 0x3fffff, 0x7fffff, 0xffffff,
0x1ffffff, 0x3ffffff, 0x7ffffff, 0xfffffff,
0x1fffffff,0x3fffffff,0x7fffffff,0xffffffff};
int i_shr;
int i_shr, i_drop = 0;
uint32_t i_result = 0;
if( i_count > 32 )
{
i_drop = i_count - 32;
i_count = 32;
}
while( i_count > 0 )
{
if( s->p >= s->p_end )
......@@ -116,18 +122,24 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
bs_forward( s, 1 );
s->i_left = 8;
}
return( i_result );
break;
}
else
{
/* less in the buffer than requested */
i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
if( -i_shr == 32 )
i_result = 0;
else
i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
i_count -= s->i_left;
bs_forward( s, 1);
s->i_left = 8;
}
}
if( i_drop )
bs_forward( s, i_drop );
return( i_result );
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment