fix segfault with lol-ffplay2.mpg (dunno if this is exploitable, probably not easily)
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Feb 2007 02:21:34 +0000 (02:21 +0000)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Feb 2007 02:21:34 +0000 (02:21 +0000)
Originally committed as revision 7889 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/mpeg12.c

index c0d1f0d..0b7cb47 100644 (file)
@@ -2593,6 +2593,10 @@ static int mpeg_decode_slice(Mpeg1Context *s1, int mb_y,
             break;
         }
     }
+    if(s->mb_x >= (unsigned)s->mb_width){
+        av_log(s->avctx, AV_LOG_ERROR, "initial skip overflow\n");
+        return -1;
+    }
 
     s->resync_mb_x= s->mb_x;
     s->resync_mb_y= s->mb_y= mb_y;