aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/indeo4.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-03-22 22:44:54 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-03-22 23:13:00 +0100
commit9759d2b886057b90355716edb23262e17f9bc3f9 (patch)
tree58c64e4e535c3e627df7d5933813ecc43c20e537 /libavcodec/indeo4.c
parentafc0cc22e17e26b99d3d662b52352945e6e7f52a (diff)
downloadffmpeg-9759d2b886057b90355716edb23262e17f9bc3f9.tar.gz
indeo4: check motion vetors.
Fixes out of heap array read. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/indeo4.c')
-rw-r--r--libavcodec/indeo4.c11
1 files changed, 10 insertions, 1 deletions
diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c
index 858af08828..8ba8e25d15 100644
--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -462,7 +462,7 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
IVITile *tile, AVCodecContext *avctx)
{
int x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb,
- mv_scale, mb_type_bits;
+ mv_scale, mb_type_bits, s;
IVIMbInfo *mb, *ref_mb;
int row_offset = band->mb_size * band->pitch;
@@ -558,6 +558,15 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band,
}
}
+ s= band->is_halfpel;
+ if (mb->type)
+ if ( x + (mv_x >>s) + (y+ (mv_y >>s))*band->pitch < 0 ||
+ x + ((mv_x+s)>>s) + band->mb_size - 1
+ + (y+band->mb_size - 1 +((mv_y+s)>>s))*band->pitch > band->height*band->pitch -1) {
+ av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", x*s + mv_x, y*s + mv_y);
+ return AVERROR_INVALIDDATA;
+ }
+
mb++;
if (ref_mb)
ref_mb++;