diff options
| author | Hendrik Leppkes <h.leppkes@gmail.com> | 2012-01-25 17:37:26 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-25 18:55:32 +0100 |
| commit | 6071644287d2a7471d906b688cb7253a5ceaaa8a (patch) | |
| tree | 126929b038c47eb09bdc7b95e1d6ca1002367d8c | |
| parent | 5cb57a16ede71d913384a0b3036a2c6df5da5e43 (diff) | |
| download | ffmpeg-6071644287d2a7471d906b688cb7253a5ceaaa8a.tar.gz | |
indeo3: fix motion vector validation
The index of the motion vector has to be checked before being
multiplied by 2 for the array index.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/indeo3.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index ce84d72f8b..fc38f5e9cb 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -772,13 +772,12 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, /* get motion vector index and setup the pointer to the mv set */ if (!ctx->need_resync) ctx->next_cell_data = &ctx->gb.buffer[(get_bits_count(&ctx->gb) + 7) >> 3]; - if(ctx->mc_vectors) - mv_idx = *(ctx->next_cell_data++) << 1; + mv_idx = *(ctx->next_cell_data++); if (mv_idx >= ctx->num_vectors) { av_log(avctx, AV_LOG_ERROR, "motion vector index out of range\n"); return AVERROR_INVALIDDATA; } - curr_cell.mv_ptr = &ctx->mc_vectors[mv_idx]; + curr_cell.mv_ptr = &ctx->mc_vectors[mv_idx << 1]; curr_cell.tree = 1; /* enter the VQ tree */ UPDATE_BITPOS(8); } else { /* VQ tree DATA code */ |