[FFmpeg-cvslog] prores: check slice mb_y against mb_height

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Oct  9 21:58:13 2011 +0200| [397d194e50e15bf20dc5950e2afe9f868c4ff2c9] | committer: Michael Niedermayer

prores: check slice mb_y against mb_height

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=397d194e50e15bf20dc5950e2afe9f868c4ff2c9
---

 libavcodec/proresdec_gpl.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/libavcodec/proresdec_gpl.c b/libavcodec/proresdec_gpl.c
index a375f9c..a97b4f7 100644
--- a/libavcodec/proresdec_gpl.c
+++ b/libavcodec/proresdec_gpl.c
@@ -223,7 +223,10 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons
     }
 
     ctx->mb_width  = (avctx->width  + 15) >> 4;
-    ctx->mb_height = (avctx->height + 15) >> 4;
+    if (ctx->frame_type)
+        ctx->mb_height = (avctx->height + 31) >> 5;
+    else
+        ctx->mb_height = (avctx->height + 15) >> 4;
 
     slice_count = AV_RB16(buf + 5);
 
@@ -282,6 +285,12 @@ static int decode_picture_header(AVCodecContext *avctx, const uint8_t *buf, cons
         }
     }
 
+    if (mb_x || mb_y != ctx->mb_height) {
+        av_log(avctx, AV_LOG_ERROR, "error wrong mb count y %d h %d\n",
+               mb_y, ctx->mb_height);
+        return -1;
+    }
+
     return pic_data_size;
 }