RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

indeo3: out of array read checks for decode_plane() 

Fixes: avi+indeo3+++1-dog.avi

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2011-11-25 18:04:17 +01:00
parent e9e642cbfb
commit 1afe49b062
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/indeo3.c
View File

@ -798,15 +798,19 @@ static int decode_plane(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
int32_t strip_width)
{
Cell curr_cell;
int num_vectors;
uint32_t num_vectors;
/* each plane data starts with mc_vector_count field, */
/* an optional array of motion vectors followed by the vq data */
num_vectors = bytestream_get_le32(&data);
if(num_vectors >= data_size/2)
return AVERROR_INVALIDDATA;
ctx->mc_vectors = num_vectors ? data : 0;
data += num_vectors * 2;
data_size-= num_vectors * 2;
/* init the bitreader */
init_get_bits(&ctx->gb, &data[num_vectors * 2], data_size << 3);
init_get_bits(&ctx->gb, data, data_size << 3);
ctx->skip_bits = 0;
ctx->need_resync = 0;