From 9759d2b886057b90355716edb23262e17f9bc3f9 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 22 Mar 2012 22:44:54 +0100 Subject: [PATCH] indeo4: check motion vetors. Fixes out of heap array read. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/indeo4.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 858af08828..8ba8e25d15 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -462,7 +462,7 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band, IVITile *tile, AVCodecContext *avctx) { int x, y, mv_x, mv_y, mv_delta, offs, mb_offset, blks_per_mb, - mv_scale, mb_type_bits; + mv_scale, mb_type_bits, s; IVIMbInfo *mb, *ref_mb; int row_offset = band->mb_size * band->pitch; @@ -558,6 +558,15 @@ static int decode_mb_info(IVI4DecContext *ctx, IVIBandDesc *band, } } + s= band->is_halfpel; + if (mb->type) + if ( x + (mv_x >>s) + (y+ (mv_y >>s))*band->pitch < 0 || + x + ((mv_x+s)>>s) + band->mb_size - 1 + + (y+band->mb_size - 1 +((mv_y+s)>>s))*band->pitch > band->height*band->pitch -1) { + av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", x*s + mv_x, y*s + mv_y); + return AVERROR_INVALIDDATA; + } + mb++; if (ref_mb) ref_mb++; -- 2.11.0