mirror of https://git.ffmpeg.org/ffmpeg.git
indeo3: Fix out of reference reading with NULL blocks.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
6fe8cb7d70
commit
50f4f272fe
|
@ -729,6 +729,7 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
|
|||
{
|
||||
Cell curr_cell;
|
||||
int bytes_used;
|
||||
int mv_x, mv_y;
|
||||
|
||||
if (depth <= 0) {
|
||||
av_log(avctx, AV_LOG_ERROR, "Stack overflow (corrupted binary tree)!\n");
|
||||
|
@ -779,6 +780,17 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
|
|||
CHECK_CELL
|
||||
if (!curr_cell.mv_ptr)
|
||||
return AVERROR_INVALIDDATA;
|
||||
|
||||
mv_y = curr_cell.mv_ptr[0];
|
||||
mv_x = curr_cell.mv_ptr[1];
|
||||
if ( mv_x + 4*curr_cell.xpos < 0
|
||||
|| mv_y + 4*curr_cell.ypos < 0
|
||||
|| mv_x + 4*curr_cell.xpos + 4*curr_cell.width > plane->width
|
||||
|| mv_y + 4*curr_cell.ypos + 4*curr_cell.height > plane->height) {
|
||||
av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*curr_cell.xpos, mv_y + 4*curr_cell.ypos);
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
copy_cell(ctx, plane, &curr_cell);
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue