diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-22 22:44:54 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-22 23:13:00 +0100 |
commit | 9759d2b886057b90355716edb23262e17f9bc3f9 (patch) | |
tree | 58c64e4e535c3e627df7d5933813ecc43c20e537 /libavcodec/indeo4.c | |
parent | afc0cc22e17e26b99d3d662b52352945e6e7f52a (diff) | |
download | ffmpeg-9759d2b886057b90355716edb23262e17f9bc3f9.tar.gz |
indeo4: check motion vetors.
Fixes out of heap array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/indeo4.c')
-rw-r--r-- | libavcodec/indeo4.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 858af08828..8ba8e25d15 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -462,7 +462,7 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band, IVITile *tile, AVCodecContext *avctx) { int x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb, - mv_scale, mb_type_bits; + mv_scale, mb_type_bits, s; IVIMbInfo *mb, *ref_mb; int row_offset = band->mb_size * band->pitch; @@ -558,6 +558,15 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band, } } + s= band->is_halfpel; + if (mb->type) + if ( x + (mv_x >>s) + (y+ (mv_y >>s))*band->pitch < 0 || + x + ((mv_x+s)>>s) + band->mb_size - 1 + + (y+band->mb_size - 1 +((mv_y+s)>>s))*band->pitch > band->height*band->pitch -1) { + av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", x*s + mv_x, y*s + mv_y); + return AVERROR_INVALIDDATA; + } + mb++; if (ref_mb) ref_mb++; |