From 2b693546ad3a8ac16bdce0b9483dc8ae7b3fdb95 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 4 Mar 2012 07:09:00 +0100 Subject: [PATCH] truemotion2: check motion vectors for validity Fixes out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/truemotion2.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index ead7a39dbf..1ccac321ac 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -638,6 +638,11 @@ static inline void tm2_motion_block(TM2Context *ctx, AVFrame *pic, int bx, int b mx = GET_TOK(ctx, TM2_MOT); my = GET_TOK(ctx, TM2_MOT); + if (4*bx+mx<0 || 4*by+my<0 || 4*bx+mx+4 > ctx->avctx->width || 4*by+my+4 > ctx->avctx->height) { + av_log(0,0, "MV out of picture\n"); + return; + } + Yo += my * oYstride + mx; Uo += (my >> 1) * oUstride + (mx >> 1); Vo += (my >> 1) * oVstride + (mx >> 1);