[FFmpeg-cvslog] cavsdec: Fix assertion failure.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Mon Sep 10 23:28:48 2012 +0200| [7ea5dbcb83a502d8152d5c64d32f9a16e7e907c7] | committer: Michael Niedermayer

cavsdec: Fix assertion failure.

The assert in decode_mb_b() is replaced by a normal error check for the
case that can occur with a damaged or crafted bitstream.

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7ea5dbcb83a502d8152d5c64d32f9a16e7e907c7
---

 libavcodec/cavsdec.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c
index 0f4f3ac..b0a18c4 100644
--- a/libavcodec/cavsdec.c
+++ b/libavcodec/cavsdec.c
@@ -820,7 +820,11 @@ static void decode_mb_b(AVSContext *h, enum cavs_mb mb_type) {
         }
         break;
     default:
-        av_assert2((mb_type > B_SYM_16X16) && (mb_type < B_8X8));
+        if (mb_type <= B_SYM_16X16) {
+            av_log(h->s.avctx, AV_LOG_ERROR, "Invalid mb_type %d in B frame\n", mb_type);
+            return AVERROR_INVALIDDATA;
+        }
+        av_assert2(mb_type < B_8X8);
         flags = ff_cavs_partition_flags[mb_type];
         if(mb_type & 1) { /* 16x8 macroblock types */
             if(flags & FWD0)