diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-09 21:13:58 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-09 21:13:58 +0200 |
| commit | 796039ad3807da88a443050fa16da313be3ce250 (patch) | |
| tree | a2a6d4e183557321e15d9726c15d569234caa10c /libavcodec/truemotion1.c | |
| parent | a56b07b5dc4fdacbb038a9fc9d51e6b98e6d12d8 (diff) | |
| parent | 858c3158b58eafee2fedd9d83651c06aa57ef217 (diff) | |
| download | ffmpeg-796039ad3807da88a443050fa16da313be3ce250.tar.gz | |
Merge branch 'release/0.8' into release/0.7
* release/0.8:
Update for 0.8.12
mpc8: fix channel checks
h263: disable loop filter with lowres
wmv1: check that the input buffer is large enough
yopdec: check frame oddness to be within supported limits
yopdec: check that palette fits in the packet
8svx: fix crash
binkaudio: check number of channels
indeo5: check quant_mat
truemotion1: Check index, fix out of array read
iff: check if there is extradata
ape: Fix null ptr dereference with files missing a seekatable.
4xm: fix division by zero caused by bps<8
jvdec: check videosize
motionpixels: check extradata size
iff_ilbm: fix null ptr deref
yop: check for missing extradata
xan: fix out of array read
cdgraphics: Fix out of array write
Conflicts:
Doxyfile
RELEASE
VERSION
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/truemotion1.c')
| -rw-r--r-- | libavcodec/truemotion1.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c index 284dbd8e12..839af44fd5 100644 --- a/libavcodec/truemotion1.c +++ b/libavcodec/truemotion1.c @@ -520,6 +520,10 @@ hres,vres,i,i%vres (0 < i < 4) } #define APPLY_C_PREDICTOR() \ + if(index > 1023){\ + av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \ + return; \ + }\ predictor_pair = s->c_predictor_table[index]; \ horiz_pred += (predictor_pair >> 1); \ if (predictor_pair & 1) { \ @@ -537,6 +541,10 @@ hres,vres,i,i%vres (0 < i < 4) index++; #define APPLY_C_PREDICTOR_24() \ + if(index > 1023){\ + av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \ + return; \ + }\ predictor_pair = s->c_predictor_table[index]; \ horiz_pred += (predictor_pair >> 1); \ if (predictor_pair & 1) { \ @@ -555,6 +563,10 @@ hres,vres,i,i%vres (0 < i < 4) #define APPLY_Y_PREDICTOR() \ + if(index > 1023){\ + av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \ + return; \ + }\ predictor_pair = s->y_predictor_table[index]; \ horiz_pred += (predictor_pair >> 1); \ if (predictor_pair & 1) { \ @@ -572,6 +584,10 @@ hres,vres,i,i%vres (0 < i < 4) index++; #define APPLY_Y_PREDICTOR_24() \ + if(index > 1023){\ + av_log(s->avctx, AV_LOG_ERROR, " index %d went out of bounds\n", index); \ + return; \ + }\ predictor_pair = s->y_predictor_table[index]; \ horiz_pred += (predictor_pair >> 1); \ if (predictor_pair & 1) { \ |