avcodec/h261dec: make while get_bits loop more robust by checking bits left

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/h261dec.c

@@ -125,8 +125,11 @@ static int h261_decode_gob_header(H261Context *h)
     }
 
     /* GEI */
-    while (get_bits1(&s->gb) != 0)
+    while (get_bits1(&s->gb) != 0) {
         skip_bits(&s->gb, 8);
+        if (get_bits_left(&s->gb) <= 0)
+            return AVERROR_INVALIDDATA;
+    }
 
     if (s->qscale == 0) {
         av_log(s->avctx, AV_LOG_ERROR, "qscale has forbidden 0 value\n");
@@ -505,8 +508,11 @@ static int h261_decode_picture_header(H261Context *h)
     skip_bits1(&s->gb); /* Reserved */
 
     /* PEI */
-    while (get_bits1(&s->gb) != 0)
+    while (get_bits1(&s->gb) != 0) {
         skip_bits(&s->gb, 8);
+        if (get_bits_left(&s->gb) <= 0)
+            return AVERROR_INVALIDDATA;
+    }
 
     /* H.261 has no I-frames, but if we pass AV_PICTURE_TYPE_I for the first
      * frame, the codec crashes if it does not contain all I-blocks