truemotion2: check motion vectors for validity

[ffmpeg] / libavcodec / truemotion2.c

diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c
index 985823dc256f47f21c7f59735a482d070a3de5d6..1ccac321aceea24e41678e899a283b6f8054a5ce 100644 (file)
--- a/libavcodec/truemotion2.c
+++ b/libavcodec/truemotion2.c
@@ -638,6 +638,11 @@ static inline void tm2_motion_block(TM2Context *ctx, AVFrame *pic, int bx, int b
     mx = GET_TOK(ctx, TM2_MOT);
     my = GET_TOK(ctx, TM2_MOT);
 
+    if (4*bx+mx<0 || 4*by+my<0 || 4*bx+mx+4 > ctx->avctx->width || 4*by+my+4 > ctx->avctx->height) {
+        av_log(0,0, "MV out of picture\n");
+        return;
+    }
+
     Yo += my * oYstride + mx;
     Uo += (my >> 1) * oUstride + (mx >> 1);
     Vo += (my >> 1) * oVstride + (mx >> 1);
@@ -767,7 +772,7 @@ static int decode_frame(AVCodecContext *avctx,
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     TM2Context * const l = avctx->priv_data;
-    AVFrame * const p= (AVFrame*)&l->pic;
+    AVFrame * const p = &l->pic;
     int i, skip, t;
 
     av_fast_padded_malloc(&l->buffer, &l->buffer_size, buf_size);