diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-02 21:52:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-14 01:29:05 +0200 |
| commit | cd24fdad470724651f6d5506ef94da92106ac6d3 (patch) | |
| tree | e29bec091aede9985f21aeb5f8d336b3a388ab1f /libavcodec | |
| parent | ee57bfc47a9867fbd59cea33430caa42006116d8 (diff) | |
| download | ffmpeg-cd24fdad470724651f6d5506ef94da92106ac6d3.tar.gz | |
mmvideo/mm_decode_inter: check horizontal coordinate too
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825317b7efda5fd12e69896b47c700303)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mmvideo.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c index ff8908a7b6..aebfe265e3 100644 --- a/libavcodec/mmvideo.c +++ b/libavcodec/mmvideo.c @@ -151,6 +151,8 @@ static int mm_decode_inter(MmContext * s, int half_horiz, int half_vert) int replace_array = bytestream2_get_byte(&s->gb); for(j=0; j<8; j++) { int replace = (replace_array >> (7-j)) & 1; + if (x + half_horiz >= s->avctx->width) + return AVERROR_INVALIDDATA; if (replace) { int color = bytestream2_get_byte(&data_ptr); s->frame.data[0][y*s->frame.linesize[0] + x] = color; |