diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-01 09:45:04 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-01 09:45:09 +0200 |
| commit | 71091698a231ca63984b2612bf16a126e6de5054 (patch) | |
| tree | 93d8b7e5b6e603744d83b297f64460bac3b56c6a | |
| parent | 14f45bcbe73fad40d13bdbd0c76b2b5ca8e40f16 (diff) | |
| parent | 95220be1faac628d849a004644c0d102df0aa98b (diff) | |
| download | ffmpeg-71091698a231ca63984b2612bf16a126e6de5054.tar.gz | |
Merge commit '95220be1faac628d849a004644c0d102df0aa98b'
* commit '95220be1faac628d849a004644c0d102df0aa98b':
indeo3: fix off by one in MV validity check
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/indeo3.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index 1ad1e4b1af..9e842cebf1 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -242,8 +242,8 @@ static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell) /* -1 because there is an extra line on top for prediction */ if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 || - ((cell->ypos + cell->height) << 2) + mv_y >= plane->height || - ((cell->xpos + cell->width) << 2) + mv_x >= plane->width) { + ((cell->ypos + cell->height) << 2) + mv_y > plane->height || + ((cell->xpos + cell->width) << 2) + mv_x > plane->width) { av_log(ctx->avctx, AV_LOG_ERROR, "Motion vectors point out of the frame.\n"); return AVERROR_INVALIDDATA; @@ -615,8 +615,8 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx, /* -1 because there is an extra line on top for prediction */ if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 || - ((cell->ypos + cell->height) << 2) + mv_y >= plane->height || - ((cell->xpos + cell->width) << 2) + mv_x >= plane->width) { + ((cell->ypos + cell->height) << 2) + mv_y > plane->height || + ((cell->xpos + cell->width) << 2) + mv_x > plane->width) { av_log(ctx->avctx, AV_LOG_ERROR, "Motion vectors point out of the frame.\n"); return AVERROR_INVALIDDATA; |