diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-10 01:51:40 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-10 01:52:14 +0100 |
| commit | dab70c62d20081bcf879b7b6bc3ffabc2e331542 (patch) | |
| tree | 55cebb0b5ccb9e9bdd6bc6f0342595c465e7bd34 | |
| parent | a93c7ca6ef625188c9ec088c2e75f731b78c9923 (diff) | |
ivi_common: check ref_tile size, fix out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/ivi_common.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index b3b6e9f13b..6cb4ea274a 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -308,7 +308,10 @@ av_cold int ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_hei tile->ref_mbs = 0; if (p || b) { - tile->ref_mbs = ref_tile->mbs; + if (tile->num_MBs <= ref_tile->num_MBs) { + tile->ref_mbs = ref_tile->mbs; + }else + av_log(0, AV_LOG_DEBUG, "Cannot use ref_tile, too few mbs\n"); ref_tile++; } |