mmvideo/mm_decode_inter: check horizontal coordinate too
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 2 May 2013 19:52:08 +0000 (21:52 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 13 May 2013 23:29:05 +0000 (01:29 +0200)
Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8d3c99e825317b7efda5fd12e69896b47c700303)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/mmvideo.c

index ff8908a..aebfe26 100644 (file)
@@ -151,6 +151,8 @@ static int mm_decode_inter(MmContext * s, int half_horiz, int half_vert)
             int replace_array = bytestream2_get_byte(&s->gb);
             for(j=0; j<8; j++) {
                 int replace = (replace_array >> (7-j)) & 1;
+                if (x + half_horiz >= s->avctx->width)
+                    return AVERROR_INVALIDDATA;
                 if (replace) {
                     int color = bytestream2_get_byte(&data_ptr);
                     s->frame.data[0][y*s->frame.linesize[0] + x] = color;