From eef5c35b4352ec49ca41f6198bee8a976b1f81e5 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Fri, 18 Nov 2011 18:08:31 +0100
Subject: [PATCH] vp3dec: Check coefficient index in vp3_dequant() Fixes
 NGS00145

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/vp3.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 23db9b9034..83ec4d80f0 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1309,6 +1309,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
+            if(i>63){
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return -1;
+            }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
             break;