RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

indeo3dec: check mv bitstream pointer 

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-26 22:11:53 +02:00
parent 8a521d57b3
commit a84851bef8
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/indeo3.c
View File

@ -801,6 +801,10 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
/* get motion vector index and setup the pointer to the mv set */ /* get motion vector index and setup the pointer to the mv set */
if (!ctx->need_resync) if (!ctx->need_resync)
ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3]; ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3];
if (ctx->next_cell_data >= ctx->last_byte) {
av_log(avctx, AV_LOG_ERROR, "motion vector out of array\n");
return AVERROR_INVALIDDATA;
}
mv_idx = *(ctx->next_cell_data++); mv_idx = *(ctx->next_cell_data++);
if (mv_idx >= ctx->num_vectors) { if (mv_idx >= ctx->num_vectors) {
av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\n"); av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\n");