[FFmpeg-cvslog] vp3dec: Check coefficient index in vp3_dequant()

[Michael Niedermayer]

ffmpeg | branch: release/0.8 | Michael Niedermayer <michaelni at gmx.at> | Fri Nov 18 18:08:31 2011 +0100| [fa5292d9d42f10841e3a889bca4ebd878c965268] | committer: Michael Niedermayer

vp3dec: Check coefficient index in vp3_dequant()
Fixes NGS00145

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit eef5c35b4352ec49ca41f6198bee8a976b1f81e5)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fa5292d9d42f10841e3a889bca4ebd878c965268
---

 libavcodec/vp3.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 549f494..2f07af8 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1308,6 +1308,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
+            if(i>63){
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return -1;
+            }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
             break;