prores: check slice mb_y against mb_height

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 10 insertions, 1 deletions

diff --git a/libavcodec/proresdec_gpl.c b/libavcodec/proresdec_gpl.c
index a375f9c957..a97b4f7f36 100644
--- a/libavcodec/proresdec_gpl.c
+++ b/libavcodec/proresdec_gpl.c
@@ -223,7 +223,10 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons
     }
 
     ctx->mb_width  = (avctx->width  + 15) >> 4;
-    ctx->mb_height = (avctx->height + 15) >> 4;
+    if (ctx->frame_type)
+        ctx->mb_height = (avctx->height + 31) >> 5;
+    else
+        ctx->mb_height = (avctx->height + 15) >> 4;
 
     slice_count = AV_RB16(buf + 5);
 
@@ -282,6 +285,12 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons
         }
     }
 
+    if (mb_x || mb_y != ctx->mb_height) {
+        av_log(avctx, AV_LOG_ERROR, "error wrong mb count y %d h %d\n",
+               mb_y, ctx->mb_height);
+        return -1;
+    }
+
     return pic_data_size;
 }