mmvideo/mm_decode_inter: check horizontal coordinate too

Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c
index bf47f6527ce0235a27cb85a8b57330c31e3f896d..36dc9f9d8a647585b1cc63bedcf6928a5cd83974 100644 (file)
--- a/libavcodec/mmvideo.c
+++ b/libavcodec/mmvideo.c
@@ -151,6 +151,8 @@ static int mm_decode_inter(MmContext * s, int half_horiz, int half_vert)
             int replace_array = bytestream2_get_byte(&s->gb);
             for(j=0; j<8; j++) {
                 int replace = (replace_array >> (7-j)) & 1;
+                if (x + half_horiz >= s->avctx->width)
+                    return AVERROR_INVALIDDATA;
                 if (replace) {
                     int color = bytestream2_get_byte(&data_ptr);
                     s->frame.data[0][y*s->frame.linesize[0] + x] = color;