| Index: chromium/patches/from_upstream/51_vp3_coefficient_overflow.patch
|
| diff --git a/chromium/patches/from_upstream/51_vp3_coefficient_overflow.patch b/chromium/patches/from_upstream/51_vp3_coefficient_overflow.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..a507a51ed70d6996e9f3dbc74bb9539a7e67a8ec
|
| --- /dev/null
|
| +++ b/chromium/patches/from_upstream/51_vp3_coefficient_overflow.patch
|
| @@ -0,0 +1,15 @@
|
| +diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
|
| +index 549f494..2f07af8 100644
|
| +--- a/libavcodec/vp3.c
|
| ++++ b/libavcodec/vp3.c
|
| +@@ -1308,6 +1308,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
|
| + case 1: // zero run
|
| + s->dct_tokens[plane][i]++;
|
| + i += (token >> 2) & 0x7f;
|
| ++ if(i>63){
|
| ++ av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
|
| ++ return -1;
|
| ++ }
|
| + block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
|
| + i++;
|
| + break;
|
|
|