[FFmpeg-cvslog] indeo3: Fix out of reference reading with NULL blocks.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Mar 10 21:12:41 2012 +0100| [50f4f272fe3f09d757f5255c722ac34a4740f969] | committer: Michael Niedermayer

indeo3: Fix out of reference reading with NULL blocks.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=50f4f272fe3f09d757f5255c722ac34a4740f969
---

 libavcodec/indeo3.c |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index b4751c2..7038cac 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -729,6 +729,7 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
 {
     Cell    curr_cell;
     int     bytes_used;
+    int mv_x, mv_y;
 
     if (depth <= 0) {
         av_log(avctx, AV_LOG_ERROR, "Stack overflow (corrupted binary tree)!\n");
@@ -779,6 +780,17 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
                 CHECK_CELL
                 if (!curr_cell.mv_ptr)
                     return AVERROR_INVALIDDATA;
+
+                mv_y = curr_cell.mv_ptr[0];
+                mv_x = curr_cell.mv_ptr[1];
+                if (   mv_x + 4*curr_cell.xpos < 0
+                    || mv_y + 4*curr_cell.ypos < 0
+                    || mv_x + 4*curr_cell.xpos + 4*curr_cell.width  > plane->width
+                    || mv_y + 4*curr_cell.ypos + 4*curr_cell.height > plane->height) {
+                    av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*curr_cell.xpos, mv_y + 4*curr_cell.ypos);
+                    return AVERROR_INVALIDDATA;
+                }
+
                 copy_cell(ctx, plane, &curr_cell);
                 return 0;
             }