From 5d6982c13bba56115125de68969f46906038b73e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 31 Mar 2012 21:42:50 +0200 Subject: indeo4: check that num_mbs matches Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit d3db8988d5befd8702a748cf1957415677bfe75c) Signed-off-by: Michael Niedermayer --- libavcodec/indeo4.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 9ce701b0f2..6763af4eb8 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -473,6 +473,11 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band, mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3); mv_x = mv_y = 0; + if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) { + av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs); + return -1; + } + for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) { mb_offset = offs; -- cgit v1.2.1