[FFmpeg-cvslog] avcodec/lagarith: check scaled probabilities

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Wed Sep 25 18:26:13 2013 +0200| [45f0623ae3fabfb4be18fe3e81390e78717f3cd0] | committer: Michael Niedermayer

avcodec/lagarith: check scaled probabilities

Prevents infinite loop
Fixes Ticket2988

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=45f0623ae3fabfb4be18fe3e81390e78717f3cd0
---

 libavcodec/lagarith.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 4285644..76c3c32 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -174,7 +174,15 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
 
     if (cumul_prob & (cumul_prob - 1)) {
         uint64_t mul = softfloat_reciprocal(cumul_prob);
-        for (i = 1; i < 257; i++) {
+        for (i = 1; i <= 128; i++) {
+            rac->prob[i] = softfloat_mul(rac->prob[i], mul);
+            scaled_cumul_prob += rac->prob[i];
+        }
+        if (scaled_cumul_prob <= 0) {
+            av_log(rac->avctx, AV_LOG_ERROR, "Scaled probabilities invalid\n");
+            return AVERROR_INVALIDDATA;
+        }
+        for (; i < 257; i++) {
             rac->prob[i] = softfloat_mul(rac->prob[i], mul);
             scaled_cumul_prob += rac->prob[i];
         }