diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 0774f82ce5..df878c5905 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -284,7 +284,6 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, { int plane, band_num, indx, transform_id, scan_indx; int i; - int quant_mat; plane = get_bits(&ctx->gb, 2); band_num = get_bits(&ctx->gb, 4); @@ -383,17 +382,18 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, band->scan = scan_index_to_tab[scan_indx]; band->scan_size = band->blk_size; - quant_mat = get_bits(&ctx->gb, 5); - if (quant_mat == 31) { - av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n"); + band->quant_mat = get_bits(&ctx->gb, 5); + if (band->quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) { + + if (band->quant_mat == 31) + av_log(avctx, AV_LOG_ERROR, + "Custom quant matrix encountered!\n"); + else + avpriv_request_sample(avctx, "Quantization matrix %d", + band->quant_mat); + band->quant_mat = -1; return AVERROR_INVALIDDATA; } - if (quant_mat >= FF_ARRAY_ELEMS(quant_index_to_tab)) { - avpriv_request_sample(avctx, "Quantization matrix %d", - quant_mat); - return AVERROR_INVALIDDATA; - } - band->quant_mat = quant_mat; } else { if (old_blk_size != band->blk_size) { av_log(avctx, AV_LOG_ERROR, @@ -401,6 +401,10 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, "inherited\n"); return AVERROR_INVALIDDATA; } + if (band->quant_mat < 0) { + av_log(avctx, AV_LOG_ERROR, "Invalid quant_mat inherited\n"); + return AVERROR_INVALIDDATA; + } } if (quant_index_to_tab[band->quant_mat] > 4 && band->blk_size == 4) { av_log(avctx, AV_LOG_ERROR, "Invalid quant matrix for 4x4 block encountered!\n");