diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 20:43:45 +0200 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2013-07-31 03:01:17 +0200 |
| commit | 24cff71d029ca87be17b04eea89e04a37523f995 (patch) | |
| tree | 2b094c4233b001d6227bdd808e28467b0f32944a /libavcodec | |
| parent | 34dfb907b222edb64bd9472a635cd29a98762392 (diff) | |
| download | ffmpeg-24cff71d029ca87be17b04eea89e04a37523f995.tar.gz | |
avcodec/kmvc: fix MV checks
Fixes Ticket2813
Fixes regression since 70b5583
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3cd8aaa2b2e78faf039691e1c31ff4f8d94e3bc6)
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/kmvc.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/kmvc.c b/libavcodec/kmvc.c index cde410e5e1..3cdae68f39 100644 --- a/libavcodec/kmvc.c +++ b/libavcodec/kmvc.c @@ -106,7 +106,7 @@ static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = val & 0xF; my = val >> 4; - if ((l0x-mx) + 320*(l0y-my) < 0 || (l0x-mx) + 320*(l0y-my) > 316*196) { + if ((l0x-mx) + 320*(l0y-my) < 0 || (l0x-mx) + 320*(l0y-my) > 320*197 - 4) { av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); return AVERROR_INVALIDDATA; } @@ -131,7 +131,7 @@ static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = val & 0xF; my = val >> 4; - if ((l1x-mx) + 320*(l1y-my) < 0 || (l1x-mx) + 320*(l1y-my) > 318*198) { + if ((l1x-mx) + 320*(l1y-my) < 0 || (l1x-mx) + 320*(l1y-my) > 320*199 - 2) { av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); return AVERROR_INVALIDDATA; } @@ -206,7 +206,7 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = (val & 0xF) - 8; my = (val >> 4) - 8; - if ((l0x+mx) + 320*(l0y+my) < 0 || (l0x+mx) + 320*(l0y+my) > 318*198) { + if ((l0x+mx) + 320*(l0y+my) < 0 || (l0x+mx) + 320*(l0y+my) > 320*197 - 4) { av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); return AVERROR_INVALIDDATA; } @@ -231,7 +231,7 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = (val & 0xF) - 8; my = (val >> 4) - 8; - if ((l1x+mx) + 320*(l1y+my) < 0 || (l1x+mx) + 320*(l1y+my) > 318*198) { + if ((l1x+mx) + 320*(l1y+my) < 0 || (l1x+mx) + 320*(l1y+my) > 320*199 - 2) { av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); return AVERROR_INVALIDDATA; } |