diff options
Diffstat (limited to 'libavcodec/eatgv.c')
| -rw-r--r-- | libavcodec/eatgv.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c index 01d0489c4c..3b19d703f9 100644 --- a/libavcodec/eatgv.c +++ b/libavcodec/eatgv.c @@ -138,7 +138,6 @@ static int unpack(const uint8_t *src, const uint8_t *src_end, unsigned char *dst * @return 0 on success, -1 on critical buffer underflow */ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *buf_end){ - unsigned last_frame_size = s->avctx->height*s->last_frame.linesize[0]; int num_mvs; int num_blocks_raw; int num_blocks_packed; @@ -158,7 +157,8 @@ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *b buf += 12; if (vector_bits > MIN_CACHE_BITS || !vector_bits) { - av_log(s->avctx, AV_LOG_ERROR, "vector_bits %d invalid\n", vector_bits); + av_log(s->avctx, AV_LOG_ERROR, + "Invalid value for motion vector bits: %d\n", vector_bits); return AVERROR_INVALIDDATA; } @@ -212,14 +212,17 @@ static int tgv_decode_inter(TgvContext * s, const uint8_t *buf, const uint8_t *b int src_stride; if (vector < num_mvs) { - unsigned offset = - (y*4 + s->mv_codebook[vector][1])*s->last_frame.linesize[0] + - x*4 + s->mv_codebook[vector][0]; + int mx = x * 4 + s->mv_codebook[vector][0]; + int my = y * 4 + s->mv_codebook[vector][1]; - src_stride = s->last_frame.linesize[0]; - if (offset >= last_frame_size - (3*src_stride+3)) + if ( mx < 0 || mx + 4 > s->avctx->width + || my < 0 || my + 4 > s->avctx->height) { + av_log(s->avctx, AV_LOG_ERROR, "MV %d %d out of picture\n", mx, my); continue; - src = s->last_frame.data[0] + offset; + } + + src = s->last_frame.data[0] + mx + my * s->last_frame.linesize[0]; + src_stride = s->last_frame.linesize[0]; }else{ int offset = vector - num_mvs; if (offset<num_blocks_raw) |