Merge commit '708e84cda1bdbffb92847f3d6ccf6fbeb26d9948'

[ffmpeg] / libavcodec / vb.c

diff --git a/libavcodec/vb.c b/libavcodec/vb.c
index 560165adc7d4e7fabcd8b6b7d5ce9a1ed232fbbb..021657f7d8757ed576eaa0976df0ae3f19a4f44f 100644 (file)
--- a/libavcodec/vb.c
+++ b/libavcodec/vb.c
@@ -205,6 +205,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     if (flags & VB_HAS_GMC) {
         i = (int16_t)bytestream2_get_le16(&c->stream);
         j = (int16_t)bytestream2_get_le16(&c->stream);
+        if (FFABS(j) > avctx->height) {
+            av_log(avctx, AV_LOG_ERROR, "GMV out of range\n");
+            return AVERROR_INVALIDDATA;
+        }
         offset = i + j * avctx->width;
     }
     if (flags & VB_HAS_VIDEO) {