Merge remote-tracking branch 'qatar/master'

[ffmpeg] / libavcodec / rv40.c

diff --git a/libavcodec/rv40.c b/libavcodec/rv40.c
index 8c157fe18daaf600a6f686c6e280719c9d6fc696..02229830872d2cd5cf622af8f0dab39443827187 100644 (file)
--- a/libavcodec/rv40.c
+++ b/libavcodec/rv40.c
@@ -231,8 +231,11 @@ static int rv40_decode_mb_info(RV34DecContext *r)
     int blocks[RV34_MB_TYPES] = {0};
     int count = 0;
 
-    if(!r->s.mb_skip_run)
+    if(!r->s.mb_skip_run) {
         r->s.mb_skip_run = svq3_get_ue_golomb(gb) + 1;
+        if(r->s.mb_skip_run > (unsigned)s->mb_num)
+            return -1;
+    }
 
     if(--r->s.mb_skip_run)
          return RV34_MB_SKIP;