generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/kmvc: fix MV checks

Browse Source 
Fixes Ticket2813
Fixes regression since 70b5583

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 3cd8aaa2b2e78faf039691e1c31ff4f8d94e3bc6)
This commit is contained in:
Michael Niedermayer 2013-07-29 20:43:45 +02:00 committed by Carl Eugen Hoyos
parent c9f34c8260
commit 2a8c3a7895
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/kmvc.c
View File

@ -106,7 +106,7 @@ static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h)
val = bytestream2_get_byte(&ctx->g);
mx = val & 0xF;
my = val >> 4;
if ((l0x-mx) + 320*(l0y-my) < 0 || (l0x-mx) + 320*(l0y-my) > 316*196) {
if ((l0x-mx) + 320*(l0y-my) < 0 || (l0x-mx) + 320*(l0y-my) > 320*197 - 4) {
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n");
return AVERROR_INVALIDDATA;
}
@ -131,7 +131,7 @@ static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h)
val = bytestream2_get_byte(&ctx->g);
mx = val & 0xF;
my = val >> 4;
if ((l1x-mx) + 320*(l1y-my) < 0 || (l1x-mx) + 320*(l1y-my) > 318*198) {
if ((l1x-mx) + 320*(l1y-my) < 0 || (l1x-mx) + 320*(l1y-my) > 320*199 - 2) {
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n");
return AVERROR_INVALIDDATA;
}
@ -206,7 +206,7 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, int w, int h)
val = bytestream2_get_byte(&ctx->g);
mx = (val & 0xF) - 8;
my = (val >> 4) - 8;
if ((l0x+mx) + 320*(l0y+my) < 0 || (l0x+mx) + 320*(l0y+my) > 318*198) {
if ((l0x+mx) + 320*(l0y+my) < 0 || (l0x+mx) + 320*(l0y+my) > 320*197 - 4) {
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n");
return AVERROR_INVALIDDATA;
}
@ -231,7 +231,7 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, int w, int h)
val = bytestream2_get_byte(&ctx->g);
mx = (val & 0xF) - 8;
my = (val >> 4) - 8;
if ((l1x+mx) + 320*(l1y+my) < 0 || (l1x+mx) + 320*(l1y+my) > 318*198) {
if ((l1x+mx) + 320*(l1y+my) < 0 || (l1x+mx) + 320*(l1y+my) > 320*199 - 2) {
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n");
return AVERROR_INVALIDDATA;
}