commit f1880e1cb98bde4a93d809cec4ce293d7d361fbe
author Angie Chiang <angiebird@google.com> Wed Apr 12 15:40:44 2017 -0700
committer Angie Chiang <angiebird@google.com> Thu Apr 13 23:27:23 2017 +0000
tree 16f080d90592deed0c5d3a70b0a481f3abc28d24
parent 8d6bc80b53cb8dbed18dff0f4a6135f3b1403cb7

Add breaking rule in the while loop of read_golomb

The while loop may become infinite loop due to bitstream error.
Therefore, we add a breaking rule to avoid that.

Change-Id: I5bcda7dea846e280b59abc97c42baf334bca2603

av1/decoder/decodetxb.c

diff --git a/av1/decoder/decodetxb.c b/av1/decoder/decodetxb.c
index a6c8cdf..d0dca63 100644
--- a/av1/decoder/decodetxb.c
+++ b/av1/decoder/decodetxb.c
@@ -17,7 +17,7 @@
 
 #define ACCT_STR __func__
 
-static int read_golomb(aom_reader *r) {
+static int read_golomb(MACROBLOCKD *xd, aom_reader *r) {
   int x = 1;
   int length = 0;
   int i = 0;
@@ -25,6 +25,11 @@
   while (!i) {
     i = aom_read_bit(r, ACCT_STR);
     ++length;
+    if (length >= 32) {
+      aom_internal_error(xd->error_info, AOM_CODEC_CORRUPT_FRAME,
+                         "Invalid length in read_golomb");
+      break;
+    }
   }
 
   for (i = 0; i < length - 1; ++i) {
@@ -179,7 +184,7 @@
     if (idx < COEFF_BASE_RANGE) continue;
 
     // decode 0-th order Golomb code
-    *v = read_golomb(r) + COEFF_BASE_RANGE + 1 + NUM_BASE_LEVELS;
+    *v = read_golomb(xd, r) + COEFF_BASE_RANGE + 1 + NUM_BASE_LEVELS;
     if (sign) *v = -(*v);
     cul_level += abs(*v);
   }