[FFmpeg-cvslog] cavsdec: check stc in decode_slice_header()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Mar 24 16:29:46 2012 +0100| [71e78e1f513ec7356b1a5011bbfc71fcd2fd391b] | committer: Michael Niedermayer

cavsdec: check stc in decode_slice_header()

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=71e78e1f513ec7356b1a5011bbfc71fcd2fd391b
---

 libavcodec/cavsdec.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index daebda2..8f87d5a 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -418,6 +418,10 @@ static void decode_mb_b(AVSContext *h, enum cavs_mb mb_type) {
 static inline int decode_slice_header(AVSContext *h, GetBitContext *gb) {
     if(h->stc > 0xAF)
         av_log(h->s.avctx, AV_LOG_ERROR, "unexpected start code 0x%02x\n", h->stc);
+
+    if (h->stc >= h->mb_height)
+        return -1;
+
     h->mby = h->stc;
     h->mbidx = h->mby*h->mb_width;