virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

indeo3: move MV check up.

Browse Source 
This adds checking for modes >= 10.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-05 02:15:35 +01:00
parent ccb76ad91f
commit e75518e18d
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavcodec/indeo3.c
View File

@ -573,6 +573,19 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
/* setup output and reference pointers */ /* setup output and reference pointers */
offset = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2); offset = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2);
block = plane->pixels[ctx->buf_sel] + offset; block = plane->pixels[ctx->buf_sel] + offset;
if (cell->mv_ptr) {
mv_y = cell->mv_ptr[0];
mv_x = cell->mv_ptr[1];
if ( mv_x + 4*cell->xpos < 0
|| mv_y + 4*cell->ypos < 0
|| mv_x + 4*cell->xpos + 4*cell->width > plane->width
|| mv_y + 4*cell->ypos + 4*cell->height > plane->height) {
av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*cell->xpos, mv_y + 4*cell->ypos);
return AVERROR_INVALIDDATA;
}
}
if (!cell->mv_ptr) { if (!cell->mv_ptr) {
/* use previous line as reference for INTRA cells */ /* use previous line as reference for INTRA cells */
ref_block = block - plane->pitch; ref_block = block - plane->pitch;
@ -584,13 +597,6 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
/* set the pointer to the reference pixels for modes 0-4 INTER */ /* set the pointer to the reference pixels for modes 0-4 INTER */
mv_y = cell->mv_ptr[0]; mv_y = cell->mv_ptr[0];
mv_x = cell->mv_ptr[1]; mv_x = cell->mv_ptr[1];
if ( mv_x + 4*cell->xpos < 0
|| mv_y + 4*cell->ypos < 0
|| mv_x + 4*cell->xpos + 4*cell->width > plane->width
|| mv_y + 4*cell->ypos + 4*cell->height > plane->height) {
av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*cell->xpos, mv_y + 4*cell->ypos);
return AVERROR_INVALIDDATA;
}
offset += mv_y * plane->pitch + mv_x; offset += mv_y * plane->pitch + mv_x;
ref_block = plane->pixels[ctx->buf_sel ^ 1] + offset; ref_block = plane->pixels[ctx->buf_sel ^ 1] + offset;
} }