diff options
| author | Daniel Kang <daniel.d.kang@gmail.com> | 2011-01-10 12:23:03 +0000 |
|---|---|---|
| committer | Peter Ross <pross@xvid.org> | 2011-01-10 12:23:03 +0000 |
| commit | 94e58e5770d2a2295a13240f51ddba583e6d5360 (patch) | |
| tree | 389988fddd2d21bc810666d3ad5ee3e7a9b53dc2 /libavcodec/mmvideo.c | |
| parent | 091bc6ca8c643bfece2c70ff2404c7b31574e1f1 (diff) | |
| download | ffmpeg-94e58e5770d2a2295a13240f51ddba583e6d5360.tar.gz | |
perform height sanity check in mmvideo decoder
Fixes issue2495
Original patch by Daniel Kang, daniel.d.kang at gmail
Originally committed as revision 26300 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/mmvideo.c')
| -rw-r--r-- | libavcodec/mmvideo.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c index 0b20ab4d1d..568a010154 100644 --- a/libavcodec/mmvideo.c +++ b/libavcodec/mmvideo.c @@ -90,6 +90,9 @@ static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const while(i<buf_size) { int run_length, color; + if (y >= s->avctx->height) + return; + if (buf[i] & 0x80) { run_length = 1; color = buf[i]; @@ -138,6 +141,9 @@ static void mm_decode_inter(MmContext * s, int half_horiz, int half_vert, const continue; } + if (y + half_vert >= s->avctx->height) + return; + for(i=0; i<length; i++) { for(j=0; j<8; j++) { int replace = (buf[r+i] >> (7-j)) & 1; |