diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-02 19:56:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-07 00:55:25 +0200 |
| commit | 95b1cbc4cb86d839cc827f083af9491cec1703c1 (patch) | |
| tree | 6d06fbe1968f51914953cc7a9b71a43fed5953f7 /libavcodec | |
| parent | 177fc2438a226d10ed70389099c0a26da1eef62a (diff) | |
| download | ffmpeg-95b1cbc4cb86d839cc827f083af9491cec1703c1.tar.gz | |
bink: fix out of reference frame read
Fixes Ticket1374
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b3675f890abee0bc446495711223a5c790234672)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/bink.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/bink.c b/libavcodec/bink.c index 8a9367d07d..4ad2e6fd76 100644 --- a/libavcodec/bink.c +++ b/libavcodec/bink.c @@ -1128,6 +1128,11 @@ static int bink_decode_plane(BinkContext *c, GetBitContext *gb, int plane_idx, xoff = get_value(c, BINK_SRC_X_OFF); yoff = get_value(c, BINK_SRC_Y_OFF); ref = prev + xoff + yoff * stride; + if (ref < ref_start || ref > ref_end) { + av_log(c->avctx, AV_LOG_ERROR, "Copy out of bounds @%d, %d\n", + bx*8 + xoff, by*8 + yoff); + return -1; + } c->dsp.put_pixels_tab[1][0](dst, ref, stride, 8); memset(dctblock, 0, sizeof(*dctblock) * 64); dctblock[0] = get_value(c, BINK_SRC_INTER_DC); |