diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2006-12-17 11:11:44 +0000 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2006-12-17 11:11:44 +0000 |
| commit | 6f3e4e1712260ef8c5b4754d781ccd80bcfa1d0c (patch) | |
| tree | a21cc8b8c4cf4fa77273e8f43f42aa08cbc2e107 | |
| parent | 3b61ab0b030d171e1d28c5f57e327a0000b90e18 (diff) | |
| download | ffmpeg-6f3e4e1712260ef8c5b4754d781ccd80bcfa1d0c.tar.gz | |
Check mb_pos is big enough before trying to access data left or above.
Fixes out-of-bound access for http://samples.mplayerhq.hu/V-codecs/WMV9/nokia_n90.wmv
Originally committed as revision 7324 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/vc1.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c index cceeccfa5c..231f3ca26c 100644 --- a/libavcodec/vc1.c +++ b/libavcodec/vc1.c @@ -3072,8 +3072,8 @@ static int vc1_decode_intra_block(VC1Context *v, DCTELEM block[64], int n, int c ac_val -= 16 * s->block_wrap[n]; q1 = s->current_picture.qscale_table[mb_pos]; - if(dc_pred_dir && c_avail) q2 = s->current_picture.qscale_table[mb_pos - 1]; - if(!dc_pred_dir && a_avail) q2 = s->current_picture.qscale_table[mb_pos - s->mb_stride]; + if(dc_pred_dir && c_avail && mb_pos) q2 = s->current_picture.qscale_table[mb_pos - 1]; + if(!dc_pred_dir && a_avail && mb_pos >= s->mb_stride) q2 = s->current_picture.qscale_table[mb_pos - s->mb_stride]; if(n && n<4) q2 = q1; if(coded) { |