diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-14 17:34:37 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-14 17:35:01 +0100 |
| commit | ccce723c6d0ea1ea89ea6c47160a07d37cdeeba2 (patch) | |
| tree | 89a4d539c7e0f76cfe2caf2d671cceb892251e53 /libavcodec | |
| parent | 87d073eaccc00ef2909445ae4b25128c440d9efa (diff) | |
vc1dec: check first field slices, fix out of array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/vc1dec.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index d9797d5315..2afe176f11 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5680,8 +5680,13 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, s->start_mb_y = (i == 0) ? 0 : FFMAX(0, slices[i-1].mby_start % mb_height); if (!v->field_mode || v->second_field) s->end_mb_y = (i == n_slices ) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height); - else + else { + if (i >= n_slices) { + av_log(v->s.avctx, AV_LOG_ERROR, "first field slice count too large\n"); + continue; + } s->end_mb_y = (i <= n_slices1 + 1) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height); + } if (s->end_mb_y <= s->start_mb_y) { av_log(v->s.avctx, AV_LOG_ERROR, "end mb y %d %d invalid\n", s->end_mb_y, s->start_mb_y); continue; |