From c98d7882d8c67475bc756ebc956fed3d4d2ca696 Mon Sep 17 00:00:00 2001
From: Laurent Aimar <fenrir@videolan.org>
Date: Tue, 27 Sep 2011 12:16:41 +0000
Subject: [PATCH] bink: Check for out of bound writes when building tree

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 24adf7832b8370f3c1febbef6c686f574d360d32)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
---
 libavcodec/bink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/bink.c b/libavcodec/bink.c
index 4f30618ff5..420d08a0f4 100644
--- a/libavcodec/bink.c
+++ b/libavcodec/bink.c
@@ -246,7 +246,7 @@ static void read_tree(GetBitContext *gb, Tree *tree)
             tree->syms[i] = get_bits(gb, 4);
             tmp1[tree->syms[i]] = 1;
         }
-        for (i = 0; i < 16; i++)
+        for (i = 0; i < 16 && len < 16 - 1; i++)
             if (!tmp1[i])
                 tree->syms[++len] = i;
     } else {