diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-21 10:39:10 -0700 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-29 22:07:01 +0200 |
| commit | 3a4949aa50cc6058a7318763af00ece259aa6749 (patch) | |
| tree | 4323cf41a953bfe527e27dadd9f5e6e912b76b94 | |
| parent | ec554ee747c966ff173551ee89fe71e19c2aeb6c (diff) | |
| download | ffmpeg-3a4949aa50cc6058a7318763af00ece259aa6749.tar.gz | |
indeo4: fix out-of-bounds function call.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
(cherry picked from commit 68fd077f68bdde864bb7328d72a040849c616261)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/indeo4.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 573718e374..3e8a3988d6 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -372,7 +372,8 @@ static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band, if (!get_bits1(&ctx->gb) || ctx->frame_type == FRAMETYPE_INTRA) { transform_id = get_bits(&ctx->gb, 5); - if (!transforms[transform_id].inv_trans) { + if (transform_id >= FF_ARRAY_ELEMS(transforms) || + !transforms[transform_id].inv_trans) { av_log_ask_for_sample(avctx, "Unimplemented transform: %d!\n", transform_id); return AVERROR_PATCHWELCOME; } |