Fix an exploit in indeo by checking we are not writing out of the strip array.

[ffmpeg] / libavcodec / svq3.c

diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c
index 499d11d6bff9757a48a14558bba827a7267a1a4c..bc02bbceacbcb568acb3bd6a8f21e86314d966cd 100644 (file)
--- a/libavcodec/svq3.c
+++ b/libavcodec/svq3.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003 The FFmpeg Project.
+ * Copyright (c) 2003 The FFmpeg Project
  *
  * This file is part of FFmpeg.
  *
@@ -37,10 +37,10 @@
  *
  * You will know you have these parameters passed correctly when the decoder
  * correctly decodes this file:
- *  ftp://ftp.mplayerhq.hu/MPlayer/samples/V-codecs/SVQ3/Vertical400kbit.sorenson3.mov
+ *  http://samples.mplayerhq.hu/V-codecs/SVQ3/Vertical400kbit.sorenson3.mov
  */
 
-#ifdef CONFIG_ZLIB
+#if CONFIG_ZLIB
 #include <zlib.h>
 #endif
 
@@ -681,6 +681,7 @@ static int svq3_decode_mb(H264Context *h, unsigned int mb_type)
         }
     }
 
+    h->cbp= cbp;
     s->current_picture.mb_type[mb_xy] = mb_type;
 
     if (IS_INTRA(mb_type)) {
@@ -788,6 +789,7 @@ static int svq3_decode_init(AVCodecContext *avctx)
     s->flags  = avctx->flags;
     s->flags2 = avctx->flags2;
     s->unrestricted_mv = 1;
+    h->is_complex=1;
 
     if (!s->context_initialized) {
         s->width  = avctx->width;
@@ -847,7 +849,7 @@ static int svq3_decode_init(AVCodecContext *avctx)
             h->unknown_svq3_flag = get_bits1(&gb);
             avctx->has_b_frames = !s->low_delay;
             if (h->unknown_svq3_flag) {
-#ifdef CONFIG_ZLIB
+#if CONFIG_ZLIB
                 unsigned watermark_width  = svq3_get_ue_golomb(&gb);
                 unsigned watermark_height = svq3_get_ue_golomb(&gb);
                 int u1 = svq3_get_ue_golomb(&gb);