[FFmpeg-cvslog] r26300 - trunk/libavcodec/mmvideo.c

[pross]

Author: pross
Date: Mon Jan 10 13:23:03 2011
New Revision: 26300

Log:
perform height sanity check in mmvideo decoder
Fixes issue2495
Original patch by Daniel Kang, daniel.d.kang at gmail

Modified:
   trunk/libavcodec/mmvideo.c

Modified: trunk/libavcodec/mmvideo.c
==============================================================================
--- trunk/libavcodec/mmvideo.c	Mon Jan 10 13:16:33 2011	(r26299)
+++ trunk/libavcodec/mmvideo.c	Mon Jan 10 13:23:03 2011	(r26300)
@@ -90,6 +90,9 @@ static void mm_decode_intra(MmContext * 
     while(i<buf_size) {
         int run_length, color;
 
+        if (y >= s->avctx->height)
+            return;
+
         if (buf[i] & 0x80) {
             run_length = 1;
             color = buf[i];
@@ -138,6 +141,9 @@ static void mm_decode_inter(MmContext * 
             continue;
         }
 
+        if (y + half_vert >= s->avctx->height)
+            return;
+
         for(i=0; i<length; i++) {
             for(j=0; j<8; j++) {
                 int replace = (buf[r+i] >> (7-j)) & 1;