X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fvp3.c;h=83ec4d80f0398b5c3507115c87a0f15a23eb2b16;hb=92afb431621c79155fcb7171d26f137eb1bee028;hp=4ede161040158f7591acae8b6b6f6b9aa7e7839b;hpb=a72580fc9efeb674257b4754ca5de0fa34b09be8;p=ffmpeg

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 4ede1610401..83ec4d80f03 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -35,6 +35,7 @@
 
 #include "libavutil/imgutils.h"
 #include "avcodec.h"
+#include "internal.h"
 #include "dsputil.h"
 #include "get_bits.h"
 
@@ -1308,6 +1309,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
+            if(i>63){
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return -1;
+            }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
             break;
@@ -2011,7 +2016,8 @@ static av_cold int vp3_decode_end(AVCodecContext *avctx)
     av_free(s->motion_val[1]);
     av_free(s->edge_emu_buffer);
 
-    if (avctx->is_copy) return 0;
+    if (avctx->internal->is_copy)
+        return 0;
 
     for (i = 0; i < 16; i++) {
         free_vlc(&s->dc_vlc[i]);