diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-15 13:29:50 +0200 |
|---|---|---|
| committer | Kostya Shishkov <kostya.shishkov@gmail.com> | 2012-05-06 19:18:02 +0200 |
| commit | 71a3c59ed73f2cad401d192278d1fcab9a129606 (patch) | |
| tree | 2ad0f23ce7776a74c692869e980d5ea12697a8fd /libavcodec | |
| parent | a390aa0ea4d537fca1cb3c188206fac927482065 (diff) | |
| download | ffmpeg-71a3c59ed73f2cad401d192278d1fcab9a129606.tar.gz | |
eatgv: check vector_bits
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Kostya Shishkov <kostya.shishkov@gmail.com>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/eatgv.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c index 9484ff1d0d..60058b29e9 100644 --- a/libavcodec/eatgv.c +++ b/libavcodec/eatgv.c @@ -154,6 +154,12 @@ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *b vector_bits = AV_RL16(&buf[6]); buf += 12; + if (vector_bits > MIN_CACHE_BITS || !vector_bits) { + av_log(s->avctx, AV_LOG_ERROR, + "Invalid value for motion vector bits: %d\n", vector_bits); + return AVERROR_INVALIDDATA; + } + /* allocate codebook buffers as necessary */ if (num_mvs > s->num_mvs) { s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int)); |