From 397d194e50e15bf20dc5950e2afe9f868c4ff2c9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 9 Oct 2011 21:58:13 +0200 Subject: [PATCH] prores: check slice mb_y against mb_height Signed-off-by: Michael Niedermayer --- libavcodec/proresdec_gpl.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavcodec/proresdec_gpl.c b/libavcodec/proresdec_gpl.c index a375f9c957..a97b4f7f36 100644 --- a/libavcodec/proresdec_gpl.c +++ b/libavcodec/proresdec_gpl.c @@ -223,7 +223,10 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons } ctx->mb_width = (avctx->width + 15) >> 4; - ctx->mb_height = (avctx->height + 15) >> 4; + if (ctx->frame_type) + ctx->mb_height = (avctx->height + 31) >> 5; + else + ctx->mb_height = (avctx->height + 15) >> 4; slice_count = AV_RB16(buf + 5); @@ -282,6 +285,12 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons } } + if (mb_x || mb_y != ctx->mb_height) { + av_log(avctx, AV_LOG_ERROR, "error wrong mb count y %d h %d\n", + mb_y, ctx->mb_height); + return -1; + } + return pic_data_size; }