dc = s->last_dc[component];
dc += diff;
s->last_dc[component] = dc;
- block[0] = dc << (3 - s->intra_dc_precision);
+ block[0] = dc * (1 << (3 - s->intra_dc_precision));
i = 0;
if (s->intra_vlc_format)
rl = &ff_rl_mpeg2;
Mpeg1Context *s1 = (Mpeg1Context *) s;
int ret;
+ if (!(avctx->flags2 & AV_CODEC_FLAG2_CHUNKS)) {
+ if (s->mb_width * s->mb_height * 11LL / (33 * 2 * 8) > buf_size)
+ return AVERROR_INVALIDDATA;
+ }
+
/* start frame decoding */
if (s->first_field || s->picture_structure == PICT_FRAME) {
AVFrameSideData *pan_scan;
return AVERROR_INVALIDDATA;
}
- if (s->avctx->hwaccel &&
- (s->avctx->slice_flags & SLICE_FLAG_ALLOW_FIELD)) {
+ if (s->avctx->hwaccel) {
if ((ret = s->avctx->hwaccel->end_frame(s->avctx)) < 0) {
av_log(avctx, AV_LOG_ERROR,
"hardware accelerator failed to decode first field\n");
start_code = -1;
buf = avpriv_find_start_code(buf, s->gb.buffer_end, &start_code);
+ if (start_code < SLICE_MIN_START_CODE || start_code > SLICE_MAX_START_CODE)
+ return AVERROR_INVALIDDATA;
mb_y = start_code - SLICE_MIN_START_CODE;
if (s->codec_id != AV_CODEC_ID_MPEG1VIDEO && s->mb_height > 2800/16)
mb_y += (*buf&0xE0)<<2;
mb_y <<= field_pic;
if (s->picture_structure == PICT_BOTTOM_FIELD)
mb_y++;
- if (mb_y < 0 || mb_y >= s->end_mb_y)
+ if (mb_y >= s->end_mb_y)
return AVERROR_INVALIDDATA;
}
}