diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-10 21:12:41 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-10 23:12:42 +0100 |
| commit | 50f4f272fe3f09d757f5255c722ac34a4740f969 (patch) | |
| tree | 49ca677dbef7782fcbebd5b053008818fbc04544 /libavcodec | |
| parent | 6fe8cb7d70414b5aa97f13fcbb4e73f9a87e706c (diff) | |
| download | ffmpeg-50f4f272fe3f09d757f5255c722ac34a4740f969.tar.gz | |
indeo3: Fix out of reference reading with NULL blocks.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/indeo3.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c index b4751c2c00..7038cac3c6 100644 --- a/libavcodec/indeo3.c +++ b/libavcodec/indeo3.c @@ -729,6 +729,7 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, { Cell curr_cell; int bytes_used; + int mv_x, mv_y; if (depth <= 0) { av_log(avctx, AV_LOG_ERROR, "Stack overflow (corrupted binary tree)!\n"); @@ -779,6 +780,17 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx, CHECK_CELL if (!curr_cell.mv_ptr) return AVERROR_INVALIDDATA; + + mv_y = curr_cell.mv_ptr[0]; + mv_x = curr_cell.mv_ptr[1]; + if ( mv_x + 4*curr_cell.xpos < 0 + || mv_y + 4*curr_cell.ypos < 0 + || mv_x + 4*curr_cell.xpos + 4*curr_cell.width > plane->width + || mv_y + 4*curr_cell.ypos + 4*curr_cell.height > plane->height) { + av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*curr_cell.xpos, mv_y + 4*curr_cell.ypos); + return AVERROR_INVALIDDATA; + } + copy_cell(ctx, plane, &curr_cell); return 0; } |