[FFmpeg-cvslog] indeo3: Check motion vectors.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Mar  4 22:32:44 2012 +0100| [56ffa3fefb22605ac6507efa046ebddc38301521] | committer: Michael Niedermayer

indeo3: Check motion vectors.

Fixes overread of reference frame.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=56ffa3fefb22605ac6507efa046ebddc38301521
---

 libavcodec/indeo3.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index 83effae..54389a1 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -584,6 +584,13 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
         /* set the pointer to the reference pixels for modes 0-4 INTER */
         mv_y      = cell->mv_ptr[0];
         mv_x      = cell->mv_ptr[1];
+        if (   mv_x + 4*cell->xpos < 0
+            || mv_y + 4*cell->ypos < 0
+            || mv_x + 4*cell->xpos + 4*cell->width  > plane->width
+            || mv_y + 4*cell->ypos + 4*cell->height > plane->height) {
+            av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*cell->xpos, mv_y + 4*cell->ypos);
+            return AVERROR_INVALIDDATA;
+        }
         offset   += mv_y * plane->pitch + mv_x;
         ref_block = plane->pixels[ctx->buf_sel ^ 1] + offset;
     }