vc1dec: Fix global array overread.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index d538c74c3e27c1abe02a830338ac033de10fb22f..d2923b9cf272b3412053d4a707d3472bedd1cdd0 100644 (file)
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -1049,8 +1049,8 @@ static void vc1_mc_4mv_chroma4(VC1Context *v)
             mquant = v->altpq;                                 \
         if ((edges&8) && s->mb_y == (s->mb_height - 1))        \
             mquant = v->altpq;                                 \
-        if (!mquant) {                                 \
-            av_log(v->s.avctx,AV_LOG_ERROR, "zero mquant\n");   \
+        if (!mquant || mquant > 31) {                          \
+            av_log(v->s.avctx, AV_LOG_ERROR, "invalid mquant %d\n", mquant);   \
             mquant = 1;                                \
         }                                              \
     }