From 94e58e5770d2a2295a13240f51ddba583e6d5360 Mon Sep 17 00:00:00 2001
From: Daniel Kang <daniel.d.kang@gmail.com>
Date: Mon, 10 Jan 2011 12:23:03 +0000
Subject: perform height sanity check in mmvideo decoder Fixes issue2495
 Original patch by Daniel Kang, daniel.d.kang at gmail

Originally committed as revision 26300 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/mmvideo.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'libavcodec/mmvideo.c')

diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c
index 0b20ab4d1d..568a010154 100644
--- a/libavcodec/mmvideo.c
+++ b/libavcodec/mmvideo.c
@@ -90,6 +90,9 @@ static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const
     while(i<buf_size) {
         int run_length, color;
 
+        if (y >= s->avctx->height)
+            return;
+
         if (buf[i] & 0x80) {
             run_length = 1;
             color = buf[i];
@@ -138,6 +141,9 @@ static void mm_decode_inter(MmContext * s, int half_horiz, int half_vert, const
             continue;
         }
 
+        if (y + half_vert >= s->avctx->height)
+            return;
+
         for(i=0; i<length; i++) {
             for(j=0; j<8; j++) {
                 int replace = (buf[r+i] >> (7-j)) & 1;
-- 
cgit v1.2.3