diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-02 21:52:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-09 21:44:03 +0200 |
| commit | 7fa6db2545643efb4fe2e0bb501fa50af35a6330 (patch) | |
| tree | bca1b2e085bc09f15382b1a1a499b61047f02a10 /libavcodec/mmvideo.c | |
| parent | 840931e76608d6b242fd416c42cd88a10bb0e42a (diff) | |
| download | ffmpeg-7fa6db2545643efb4fe2e0bb501fa50af35a6330.tar.gz | |
mmvideo/mm_decode_inter: check horizontal coordinate too
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825317b7efda5fd12e69896b47c700303)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mmvideo.c')
| -rw-r--r-- | libavcodec/mmvideo.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c index c61cd576e4..4214eeb964 100644 --- a/libavcodec/mmvideo.c +++ b/libavcodec/mmvideo.c @@ -151,6 +151,8 @@ static int mm_decode_inter(MmContext * s, int half_horiz, int half_vert) int replace_array = bytestream2_get_byte(&s->gb); for(j=0; j<8; j++) { int replace = (replace_array >> (7-j)) & 1; + if (x + half_horiz >= s->avctx->width) + return AVERROR_INVALIDDATA; if (replace) { int color = bytestream2_get_byte(&data_ptr); s->frame.data[0][y*s->frame.linesize[0] + x] = color; |