|
prec->zerobits[pos].val = expn[bandno] + numgbits - 1 - cblk->nonzerobits; |
This line might lead to overflow when (expn[bandno] + numgbits - 1) < cblk->nonzerobits becomes true because prec->zerobits[pos].val is uint8_t.
I propose to add a line for checking like
if ((expn[bandno] + numgbits - 1) < cblk->nonzerobits)
av_log(avvtx, AV_LOG_ERROR, "Number of magnitude bit-planes is too big.\n");