Merge commit '6fee1b90ce3bf4fbdfde7016e0890057c9000487'

[ffmpeg] / libavcodec / mmvideo.c

diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c
index bf47f6527ce0235a27cb85a8b57330c31e3f896d..292ebe68b9f550edd4f9c30db46d899fb946d9a2 100644 (file)
--- a/libavcodec/mmvideo.c
+++ b/libavcodec/mmvideo.c
@@ -104,6 +104,9 @@ static int mm_decode_intra(MmContext * s, int half_horiz, int half_vert)
         if (half_horiz)
             run_length *=2;
 
+        if (run_length > s->avctx->width - x)
+            return AVERROR_INVALIDDATA;
+
         if (color) {
             memset(s->frame.data[0] + y*s->frame.linesize[0] + x, color, run_length);
             if (half_vert)
@@ -151,6 +154,8 @@ static int mm_decode_inter(MmContext * s, int half_horiz, int half_vert)
             int replace_array = bytestream2_get_byte(&s->gb);
             for(j=0; j<8; j++) {
                 int replace = (replace_array >> (7-j)) & 1;
+                if (x + half_horiz >= s->avctx->width)
+                    return AVERROR_INVALIDDATA;
                 if (replace) {
                     int color = bytestream2_get_byte(&data_ptr);
                     s->frame.data[0][y*s->frame.linesize[0] + x] = color;