Thoroughly check all fields set by the application in xvmc struct.

Originally committed as revision 17387 to svn://svn.ffmpeg.org/ffmpeg/trunk

1 files changed, 5 insertions, 1 deletions

diff --git a/libavcodec/mpegvideo_xvmc.c b/libavcodec/mpegvideo_xvmc.c
index 3d56bec374..ade72739cd 100644
--- a/libavcodec/mpegvideo_xvmc.c
+++ b/libavcodec/mpegvideo_xvmc.c
@@ -90,7 +90,11 @@ int ff_xvmc_field_start(MpegEncContext *s, AVCodecContext *avctx)
         return -1;
     }
     if (render->allocated_mv_blocks   < 1 ||
-        render->allocated_data_blocks < mb_block_count) {
+        render->allocated_data_blocks <  render->allocated_mv_blocks*mb_block_count ||
+        render->start_mv_blocks_num   >= render->allocated_mv_blocks                ||
+        render->next_free_data_block_num >
+                        render->allocated_data_blocks -
+                        mb_block_count*(render->allocated_mv_blocks-render->start_mv_blocks_num)) {
         av_log(avctx, AV_LOG_ERROR,
                "Rendering surface doesn't provide enough block structures to work with.\n");
         return -1;