har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix segfault with dracula.4xm

Browse Source 
closes issue132

Originally committed as revision 10392 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Michael Niedermayer 2007-09-05 01:14:17 +00:00
parent 46491f138c
commit f9f835ee89
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/4xm.c
View File

@ -301,11 +301,17 @@ static void decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int lo
const int index= size2index[log2h][log2w]; const int index= size2index[log2h][log2w];
const int h= 1<<log2h; const int h= 1<<log2h;
int code= get_vlc2(&f->gb, block_type_vlc[1-f->version][index].table, BLOCK_TYPE_VLC_BITS, 1); int code= get_vlc2(&f->gb, block_type_vlc[1-f->version][index].table, BLOCK_TYPE_VLC_BITS, 1);
uint16_t *start= f->last_picture.data[0];
uint16_t *end= start + stride*(f->avctx->height-h+1) - (1<<log2w);
assert(code>=0 && code<=6); assert(code>=0 && code<=6);
if(code == 0){ if(code == 0){
src += f->mv[ *f->bytestream++ ]; src += f->mv[ *f->bytestream++ ];
if(start > src || src > end){
av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
return;
}
mcdc(dst, src, log2w, h, stride, 1, 0); mcdc(dst, src, log2w, h, stride, 1, 0);
}else if(code == 1){ }else if(code == 1){
log2h--; log2h--;
@ -319,6 +325,10 @@ static void decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int lo
mcdc(dst, src, log2w, h, stride, 1, 0); mcdc(dst, src, log2w, h, stride, 1, 0);
}else if(code == 4){ }else if(code == 4){
src += f->mv[ *f->bytestream++ ]; src += f->mv[ *f->bytestream++ ];
if(start > src || src > end){
av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");
return;
}
mcdc(dst, src, log2w, h, stride, 1, le2me_16(*f->wordstream++)); mcdc(dst, src, log2w, h, stride, 1, le2me_16(*f->wordstream++));
}else if(code == 5){ }else if(code == 5){
mcdc(dst, src, log2w, h, stride, 0, le2me_16(*f->wordstream++)); mcdc(dst, src, log2w, h, stride, 0, le2me_16(*f->wordstream++));