indeo4: Fix global array overread.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 24 Mar 2012 11:29:05 +0000 (12:29 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 24 Mar 2012 13:54:11 +0000 (14:54 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/indeo4.c

index 1d280a0..1265201 100644 (file)
@@ -404,6 +404,10 @@ static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band,
                 av_log(avctx, AV_LOG_ERROR, "Custom quant matrix encountered!\n");
                 return AVERROR_INVALIDDATA;
             }
+            if (band->quant_mat > 21) {
+                av_log(avctx, AV_LOG_ERROR, "Invalid quant matrix encountered!\n");
+                return AVERROR_INVALIDDATA;
+            }
         }
 
         /* decode block huffman codebook */