diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-28 10:44:43 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-28 10:44:43 +0200 |
| commit | a60a4d704149ab51bd27b63ae763c1d26d075013 (patch) | |
| tree | 4f873eb001a7ffdb61905d441ca8c7714fcc225b /libavcodec/vc1dec.c | |
| parent | 8db2935db0caa8efbef009994920ef6a20289496 (diff) | |
vc1dec: Fix global array overread.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vc1dec.c')
| -rw-r--r-- | libavcodec/vc1dec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index d538c74c3e..d2923b9cf2 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -1049,8 +1049,8 @@ static void vc1_mc_4mv_chroma4(VC1Context *v) mquant = v->altpq; \ if ((edges&8) && s->mb_y == (s->mb_height - 1)) \ mquant = v->altpq; \ - if (!mquant) { \ - av_log(v->s.avctx,AV_LOG_ERROR, "zero mquant\n"); \ + if (!mquant || mquant > 31) { \ + av_log(v->s.avctx, AV_LOG_ERROR, "invalid mquant %d\n", mquant); \ mquant = 1; \ } \ } |