From dab70c62d20081bcf879b7b6bc3ffabc2e331542 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 Nov 2012 01:51:40 +0100 Subject: ivi_common: check ref_tile size, fix out of array accesses Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/ivi_common.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index b3b6e9f13b..6cb4ea274a 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -308,7 +308,10 @@ av_cold int ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_hei tile->ref_mbs = 0; if (p || b) { - tile->ref_mbs = ref_tile->mbs; + if (tile->num_MBs <= ref_tile->num_MBs) { + tile->ref_mbs = ref_tile->mbs; + }else + av_log(0, AV_LOG_DEBUG, "Cannot use ref_tile, too few mbs\n"); ref_tile++; } -- cgit v1.2.3