generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

indeo3: fix off by one in MV validity check

Browse Source 
CC:libav-stable@libav.org
(cherry picked from commit 95220be1fa)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Anton Khirnov
2013-04-27 18:01:51 +02:00
committed by Reinhard Tartler
parent a590979988
commit 6742f0408d
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/indeo3.c
View File

@@ -235,8 +235,8 @@ static int copy_cell(Indeo3DecodeContext *ctx, Plane *plane, Cell *cell)
/* -1 because there is an extra line on top for prediction */
if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||
((cell->ypos + cell->height) << 2) + mv_y >= plane->height ||
((cell->xpos + cell->width) << 2) + mv_x >= plane->width) {
((cell->ypos + cell->height) << 2) + mv_y > plane->height ||
((cell->xpos + cell->width) << 2) + mv_x > plane->width) {
av_log(ctx->avctx, AV_LOG_ERROR,
"Motion vectors point out of the frame.\n");
return AVERROR_INVALIDDATA;
@@ -606,8 +606,8 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
/* -1 because there is an extra line on top for prediction */
if ((cell->ypos << 2) + mv_y < -1 || (cell->xpos << 2) + mv_x < 0 ||
((cell->ypos + cell->height) << 2) + mv_y >= plane->height ||
((cell->xpos + cell->width) << 2) + mv_x >= plane->width) {
((cell->ypos + cell->height) << 2) + mv_y > plane->height ||
((cell->xpos + cell->width) << 2) + mv_x > plane->width) {
av_log(ctx->avctx, AV_LOG_ERROR,
"Motion vectors point out of the frame.\n");
return AVERROR_INVALIDDATA;