From 796f8ecf243736c88d123e70ba7b1c108dceeba1 Mon Sep 17 00:00:00 2001
From: Francois Cartegnie <fcvlcdev@free.fr>
Date: Fri, 1 Dec 2017 15:09:30 +0100
Subject: [PATCH] vlc_bits: add shift guard on bs_read

and reject any reads > 32

(cherry picked from commit 86c35629d7f095b372b00b1d3918528bbeb0b5a7)
---
 include/vlc_bits.h | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/include/vlc_bits.h b/include/vlc_bits.h
index 018e306731..395a789eba 100644
--- a/include/vlc_bits.h
+++ b/include/vlc_bits.h
@@ -96,9 +96,15 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
         0x1fffff,  0x3fffff,  0x7fffff,  0xffffff,
         0x1ffffff, 0x3ffffff, 0x7ffffff, 0xfffffff,
         0x1fffffff,0x3fffffff,0x7fffffff,0xffffffff};
-    int      i_shr;
+    int      i_shr, i_drop = 0;
     uint32_t i_result = 0;
 
+    if( i_count > 32 )
+    {
+        i_drop = i_count - 32;
+        i_count = 32;
+    }
+
     while( i_count > 0 )
     {
         if( s->p >= s->p_end )
@@ -116,18 +122,24 @@ static inline uint32_t bs_read( bs_t *s, int i_count )
                 bs_forward( s, 1 );
                 s->i_left = 8;
             }
-            return( i_result );
+            break;
         }
         else
         {
             /* less in the buffer than requested */
-           i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
+           if( -i_shr == 32 )
+               i_result = 0;
+           else
+               i_result |= (*s->p&i_mask[s->i_left]) << -i_shr;
            i_count  -= s->i_left;
            bs_forward( s, 1);
            s->i_left = 8;
         }
     }
 
+    if( i_drop )
+        bs_forward( s, i_drop );
+
     return( i_result );
 }