[FFmpeg-cvslog] indeo4: more complete check for the scan vs block sizes.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Mon Nov 12 21:50:20 2012 +0100| [7ab690bf5f4b24fca95113c0ee44f0847c9c3c6d] | committer: Michael Niedermayer

indeo4: more complete check for the scan vs block sizes.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7ab690bf5f4b24fca95113c0ee44f0847c9c3c6d
---

 libavcodec/indeo4.c     |    6 ++++++
 libavcodec/ivi_common.h |    1 +
 2 files changed, 7 insertions(+)

diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c
index 1d6d049..0766ed4 100644
--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -365,6 +365,7 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
                 return AVERROR_INVALIDDATA;
             }
             band->scan = scan_index_to_tab[scan_indx];
+            band->scan_size = band->blk_size;
 
             quant_mat = get_bits(&ctx->gb, 5);
             if (quant_mat == 31) {
@@ -382,6 +383,11 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
             band->quant_mat = 0;
             return AVERROR_INVALIDDATA;
         }
+        if (band->scan_size != band->blk_size) {
+            av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         /* decode block huffman codebook */
         if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF,
                                  &band->blk_vlc, avctx))
diff --git a/libavcodec/ivi_common.h b/libavcodec/ivi_common.h
index 44b28cd..e3afe43 100644
--- a/libavcodec/ivi_common.h
+++ b/libavcodec/ivi_common.h
@@ -152,6 +152,7 @@ typedef struct IVIBandDesc {
     int             quant_mat;      ///< dequant matrix index
     int             glob_quant;     ///< quant base for this band
     const uint8_t   *scan;          ///< ptr to the scan pattern
+    int             scan_size;      ///< size of the scantable
 
     IVIHuffTab      blk_vlc;        ///< vlc table for decoding block data