Merge remote-tracking branch 'qatar/master'
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 14 Jul 2013 11:37:40 +0000 (13:37 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 14 Jul 2013 11:37:40 +0000 (13:37 +0200)
* qatar/master:
  indeo: Bound-check before applying transform

Conflicts:
libavcodec/indeo4.c
libavcodec/indeo5.c
libavcodec/ivi_common.c

See: af388237093ed6df6f5118b34ef938a2ca2ffbda0846719dd11ab3f7a7caee13e7af71f71d913389
Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/indeo4.c
libavcodec/indeo5.c
libavcodec/ivi_common.c
libavcodec/ivi_common.h

@@@ -352,7 -346,13 +352,14 @@@ static int decode_band_hdr(IVI45DecCont
              band->inv_transform = transforms[transform_id].inv_trans;
              band->dc_transform  = transforms[transform_id].dc_trans;
              band->is_2d_trans   = transforms[transform_id].is_2d_trans;
-             band->transform_size= (transform_id < 10) ? 8 : 4;
++
+             if (transform_id < 10)
+                 band->transform_size = 8;
+             else
+                 band->transform_size = 4;
+             if (band->blk_size != band->transform_size)
+                 return AVERROR_INVALIDDATA;
  
              scan_indx = get_bits(&ctx->gb, 4);
              if (scan_indx == 15) {
Simple merge
@@@ -415,6 -407,24 +415,20 @@@ static int ivi_dec_tile_data_size(GetBi
      return len;
  }
  
 -    if (!band->dc_transform)
 -        return 0;
 -
 -
+ static int ivi_dc_transform(IVIBandDesc *band, int *prev_dc, int buf_offs,
+                             int blk_size)
+ {
+     int buf_size = band->pitch * band->aheight - buf_offs;
+     int min_size = (blk_size - 1) * band->pitch + blk_size;
+     if (min_size > buf_size)
+         return AVERROR_INVALIDDATA;
+     band->dc_transform(prev_dc, band->buf + buf_offs,
+                        band->pitch, blk_size);
+     return 0;
+ }
  
  static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band,
                                     ivi_mc_func mc, int mv_x, int mv_y,
Simple merge