diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-02 21:52:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-02 22:05:19 +0200 |
| commit | 8d3c99e825317b7efda5fd12e69896b47c700303 (patch) | |
| tree | 7cd5b762baf7d6fc0d071bbc8398098e5b9e02e4 | |
| parent | fd68371b072824ee6f63e38e1b2f6921a05bedcc (diff) | |
| download | ffmpeg-8d3c99e825317b7efda5fd12e69896b47c700303.tar.gz | |
mmvideo/mm_decode_inter: check horizontal coordinate too
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/mmvideo.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c index bf47f6527c..36dc9f9d8a 100644 --- a/libavcodec/mmvideo.c +++ b/libavcodec/mmvideo.c @@ -151,6 +151,8 @@ static int mm_decode_inter(MmContext * s, int half_horiz, int half_vert) int replace_array = bytestream2_get_byte(&s->gb); for(j=0; j<8; j++) { int replace = (replace_array >> (7-j)) & 1; + if (x + half_horiz >= s->avctx->width) + return AVERROR_INVALIDDATA; if (replace) { int color = bytestream2_get_byte(&data_ptr); s->frame.data[0][y*s->frame.linesize[0] + x] = color; |