diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-28 23:46:32 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2018-06-30 00:41:35 +0200 |
| commit | d08d4a8c7387e758d439b0592782e4cfa2b4d6a4 (patch) | |
| tree | 6db5e20e5a1ebd42cb0196cade7c68f2d26fecb7 /libavcodec/vc1_block.c | |
| parent | 5a99e00023c057555697c73b2119f378b019c5fa (diff) | |
avcodec/vc1_block: Fix mqaunt check for negative values
Fixes: out of array access
Fixes: ffmpeg_bof_4.avi
Fixes: ffmpeg_bof_5.avi
Fixes: ffmpeg_bof_6.avi
Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Reviewed-by: Jerome Borsboom <jerome.borsboom@carpalis.nl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/vc1_block.c')
| -rw-r--r-- | libavcodec/vc1_block.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/vc1_block.c b/libavcodec/vc1_block.c index dfaaab700b..86320db959 100644 --- a/libavcodec/vc1_block.c +++ b/libavcodec/vc1_block.c @@ -207,7 +207,7 @@ static void vc1_put_blocks_clamped(VC1Context *v, int put_signed) if ((edges&8) && \ s->mb_y == ((s->mb_height >> v->field_mode) - 1)) \ mquant = -v->altpq; \ - if (!mquant || mquant > 31) { \ + if (!mquant || mquant > 31 || mquant < -31) { \ av_log(v->s.avctx, AV_LOG_ERROR, \ "Overriding invalid mquant %d\n", mquant); \ mquant = 1; \ |