cbp = 0; /* avoid warning. FIXME: find a solution without slowing
down the code */
if (sl->slice_type_nos != AV_PICTURE_TYPE_I) {
- if (sl->mb_skip_run == -1)
- sl->mb_skip_run = get_ue_golomb_long(&sl->gb);
+ if (sl->mb_skip_run == -1) {
+ unsigned mb_skip_run = get_ue_golomb_long(&sl->gb);
+ if (mb_skip_run > h->mb_num) {
+ av_log(h->avctx, AV_LOG_ERROR, "mb_skip_run %d is invalid\n", mb_skip_run);
+ return AVERROR_INVALIDDATA;
+ }
+ sl->mb_skip_run = mb_skip_run;
+ }
if (sl->mb_skip_run--) {
if (FRAME_MBAFF(h) && (sl->mb_y & 1) == 0) {
const int index= 4*i + block_width*j;
int16_t (* mv_cache)[2]= &sl->mv_cache[list][ scan8[index] ];
pred_motion(h, sl, index, block_width, list, sl->ref_cache[list][ scan8[index] ], &mx, &my);
- mx += get_se_golomb(&sl->gb);
- my += get_se_golomb(&sl->gb);
+ mx += (unsigned)get_se_golomb(&sl->gb);
+ my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
if(IS_SUB_8X8(sub_mb_type)){
for (list = 0; list < sl->list_count; list++) {
if(IS_DIR(mb_type, 0, list)){
pred_motion(h, sl, 0, 4, list, sl->ref_cache[list][ scan8[0] ], &mx, &my);
- mx += get_se_golomb(&sl->gb);
- my += get_se_golomb(&sl->gb);
+ mx += (unsigned)get_se_golomb(&sl->gb);
+ my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
fill_rectangle(sl->mv_cache[list][ scan8[0] ], 4, 4, 8, pack16to32(mx,my), 4);
unsigned int val;
if(IS_DIR(mb_type, i, list)){
pred_16x8_motion(h, sl, 8*i, list, sl->ref_cache[list][scan8[0] + 16*i], &mx, &my);
- mx += get_se_golomb(&sl->gb);
- my += get_se_golomb(&sl->gb);
+ mx += (unsigned)get_se_golomb(&sl->gb);
+ my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
val= pack16to32(mx,my);
unsigned int val;
if(IS_DIR(mb_type, i, list)){
pred_8x16_motion(h, sl, i*4, list, sl->ref_cache[list][ scan8[0] + 2*i ], &mx, &my);
- mx += get_se_golomb(&sl->gb);
- my += get_se_golomb(&sl->gb);
+ mx += (unsigned)get_se_golomb(&sl->gb);
+ my += (unsigned)get_se_golomb(&sl->gb);
ff_tlog(h->avctx, "final mv:%d %d\n", mx, my);
val= pack16to32(mx,my);