} else {
int plane;
+ if (c->pmb_width * c->pmb_height > 8LL*(buf_size - bytestream2_tell(&gb)))
+ return AVERROR_INVALIDDATA;
+
if ((ret = ff_reget_buffer(avctx, c->pic)) < 0)
return ret;
for (j = 0; j < c->pmb_height; j++) {
for (i = 0; i < c->pmb_width; i++) {
+ if (get_bits_left(&c->gb) <= 0)
+ return AVERROR_INVALIDDATA;
if (get_bits1(&c->gb)) {
MV mv = mvi_predict(&c->mvi, i, j, zero_mv);
*got_frame = 1;
+ if (get_bits_left(&c->gb) < 0)
+ av_log(c->avctx, AV_LOG_WARNING, "overread %d\n", -get_bits_left(&c->gb));
+
return mb_ret < 0 ? mb_ret : buf_size;
}