[FFmpeg-cvslog] avcodec/ansi: Check x/y

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu May  2 02:15:03 2013 +0200| [e91fd754c63de7fd3cb7fdea8974166db362e387] | committer: Michael Niedermayer

avcodec/ansi: Check x/y

This prevents out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=e91fd754c63de7fd3cb7fdea8974166db362e387
---

 libavcodec/ansi.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/ansi.c b/libavcodec/ansi.c
index 93915f8..07eeaff 100644
--- a/libavcodec/ansi.c
+++ b/libavcodec/ansi.c
@@ -243,6 +243,8 @@ static int execute_code(AVCodecContext * avctx, int c)
         default:
             avpriv_request_sample(avctx, "Unsupported screen mode");
         }
+        s->x = av_clip(s->x, 0, width  - FONT_WIDTH);
+        s->y = av_clip(s->y, 0, height - s->font_height);
         if (width != avctx->width || height != avctx->height) {
             av_frame_unref(s->frame);
             avcodec_set_dimensions(avctx, width, height);
@@ -336,6 +338,8 @@ static int execute_code(AVCodecContext * avctx, int c)
         avpriv_request_sample(avctx, "Unknown escape code");
         break;
     }
+    s->x = av_clip(s->x, 0, avctx->width  - FONT_WIDTH);
+    s->y = av_clip(s->y, 0, avctx->height - s->font_height);
     return 0;
 }