From 6f3e4e1712260ef8c5b4754d781ccd80bcfa1d0c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= <Reimar.Doeffinger@gmx.de>
Date: Sun, 17 Dec 2006 11:11:44 +0000
Subject: [PATCH] Check mb_pos is big enough before trying to access data left
or above. Fixes out-of-bound access for
http://samples.mplayerhq.hu/V-codecs/WMV9/nokia_n90.wmv
Originally committed as revision 7324 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
libavcodec/vc1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/vc1.c b/libavcodec/vc1.c
index cceeccfa5c..231f3ca26c 100644
--- a/libavcodec/vc1.c
+++ b/libavcodec/vc1.c
@@ -3072,8 +3072,8 @@ static int vc1_decode_intra_block(VC1Context *v, DCTELEM block[64], int n, int c
ac_val -= 16 * s->block_wrap[n];
q1 = s->current_picture.qscale_table[mb_pos];
- if(dc_pred_dir && c_avail) q2 = s->current_picture.qscale_table[mb_pos - 1];
- if(!dc_pred_dir && a_avail) q2 = s->current_picture.qscale_table[mb_pos - s->mb_stride];
+ if(dc_pred_dir && c_avail && mb_pos) q2 = s->current_picture.qscale_table[mb_pos - 1];
+ if(!dc_pred_dir && a_avail && mb_pos >= s->mb_stride) q2 = s->current_picture.qscale_table[mb_pos - s->mb_stride];
if(n && n<4) q2 = q1;
if(coded) {