[vlc-commits] vlc_bits: add shift guard on bs_read

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Dec  1 15:09:30 2017 +0100| [f1d8cedd9def18f563ef181ac670a0f2a66e619a] | committer: Francois Cartegnie

vlc_bits: add shift guard on bs_read

and reject any reads > 32

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=f1d8cedd9def18f563ef181ac670a0f2a66e619a
---

 include/vlc_bits.h | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/include/vlc_bits.h b/include/vlc_bits.h
index 018e306731..b21e33ebbc 100644
--- a/include/vlc_bits.h
+++ b/include/vlc_bits.h
@@ -96,9 +96,15 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
         0x1fffff,  0x3fffff,  0x7fffff,  0xffffff,
         0x1ffffff, 0x3ffffff, 0x7ffffff, 0xfffffff,
         0x1fffffff,0x3fffffff,0x7fffffff,0xffffffff};
-    int      i_shr;
+    int      i_shr, i_drop = 0;
     uint32_t i_result = 0;
 
+    if( i_count > 32 )
+    {
+        i_drop = i_count - 32;
+        i_count = 32;
+    }
+
     while( i_count > 0 )
     {
         if( s->p >= s->p_end )
@@ -116,18 +122,22 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
                 bs_forward( s, 1 );
                 s->i_left = 8;
             }
-            return( i_result );
+            break;
         }
         else
         {
             /* less in the buffer than requested */
-           i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
+           if( i_result )
+              i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
            i_count  -= s->i_left;
            bs_forward( s, 1);
            s->i_left = 8;
         }
     }
 
+    if( i_drop )
+        bs_forward( s, i_drop );
+
     return( i_result );
 }