diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-04 07:09:00 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-04 07:09:35 +0100 |
| commit | 2b693546ad3a8ac16bdce0b9483dc8ae7b3fdb95 (patch) | |
| tree | c5bb20bf988ae45482e1922878684d3fcd4dafdd /libavcodec/truemotion2.c | |
| parent | 39a3a53b66fcc115bd8d0bc0a70db66791eab854 (diff) | |
truemotion2: check motion vectors for validity
Fixes out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/truemotion2.c')
| -rw-r--r-- | libavcodec/truemotion2.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index ead7a39dbf..1ccac321ac 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -638,6 +638,11 @@ static inline void tm2_motion_block(TM2Context *ctx, AVFrame *pic, int bx, int b mx = GET_TOK(ctx, TM2_MOT); my = GET_TOK(ctx, TM2_MOT); + if (4*bx+mx<0 || 4*by+my<0 || 4*bx+mx+4 > ctx->avctx->width || 4*by+my+4 > ctx->avctx->height) { + av_log(0,0, "MV out of picture\n"); + return; + } + Yo += my * oYstride + mx; Uo += (my >> 1) * oUstride + (mx >> 1); Vo += (my >> 1) * oVstride + (mx >> 1); |