avcodec/dnxhdenc: fix possible out of bound writes for big w/h

It was caused by integer overflows.

2 files changed, 4 insertions, 1 deletions

diff --git a/libavcodec/dnxhdenc.c b/libavcodec/dnxhdenc.c
index ac92474e56..374fec499b 100644
--- a/libavcodec/dnxhdenc.c
+++ b/libavcodec/dnxhdenc.c
@@ -1228,6 +1228,9 @@ static int dnxhd_encode_fast(AVCodecContext *avctx, DNXHDEncContext *ctx)
             ctx->mb_qscale[mb] = ctx->qscale + 1;
             ctx->mb_bits[mb]   = ctx->mb_rc[rc + ctx->m.mb_num].bits;
         }
+
+        if (max_bits > ctx->frame_bits)
+            return AVERROR(EINVAL);
     }
     return 0;
 }
diff --git a/libavcodec/dnxhdenc.h b/libavcodec/dnxhdenc.h
index 9e4c869bc4..30ae8c15e3 100644
--- a/libavcodec/dnxhdenc.h
+++ b/libavcodec/dnxhdenc.h
@@ -34,7 +34,7 @@
 #include "dnxhddata.h"
 
 typedef struct RCCMPEntry {
-    uint16_t mb;
+    uint32_t mb;
     int value;
 } RCCMPEntry;