X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fvb.c;h=021657f7d8757ed576eaa0976df0ae3f19a4f44f;hb=2d025e742843ca3532bd49ebbfebeacd51337347;hp=560165adc7d4e7fabcd8b6b7d5ce9a1ed232fbbb;hpb=cb0eba71f047944ccc1220fca04c50f45f88a8ff;p=ffmpeg

diff --git a/libavcodec/vb.c b/libavcodec/vb.c
index 560165adc7d..021657f7d87 100644
--- a/libavcodec/vb.c
+++ b/libavcodec/vb.c
@@ -205,6 +205,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     if (flags & VB_HAS_GMC) {
         i = (int16_t)bytestream2_get_le16(&c->stream);
         j = (int16_t)bytestream2_get_le16(&c->stream);
+        if (FFABS(j) > avctx->height) {
+            av_log(avctx, AV_LOG_ERROR, "GMV out of range\n");
+            return AVERROR_INVALIDDATA;
+        }
         offset = i + j * avctx->width;
     }
     if (flags & VB_HAS_VIDEO) {