cbp = 0; /* avoid warning. FIXME: find a solution without slowing
down the code */
if (sl->slice_type_nos != AV_PICTURE_TYPE_I) {
- if (sl->mb_skip_run == -1)
- sl->mb_skip_run = get_ue_golomb_long(&sl->gb);
+ if (sl->mb_skip_run == -1) {
+ unsigned mb_skip_run = get_ue_golomb_long(&sl->gb);
+ if (mb_skip_run > h->mb_num) {
+ av_log(h->avctx, AV_LOG_ERROR, "mb_skip_run %d is invalid\n", mb_skip_run);
+ return AVERROR_INVALIDDATA;
+ }
+ sl->mb_skip_run = mb_skip_run;
+ }
if (sl->mb_skip_run--) {
if (FRAME_MBAFF(h) && (sl->mb_y & 1) == 0) {