ivi_common: check ref_tile size, fix out of array accesses
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 10 Nov 2012 00:51:40 +0000 (01:51 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 10 Nov 2012 00:52:14 +0000 (01:52 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/ivi_common.c

index b3b6e9f..6cb4ea2 100644 (file)
@@ -308,7 +308,10 @@ av_cold int ff_ivi_init_tiles(IVIPlaneDesc *planes, int tile_width, int tile_hei
 
                     tile->ref_mbs = 0;
                     if (p || b) {
-                        tile->ref_mbs = ref_tile->mbs;
+                        if (tile->num_MBs <= ref_tile->num_MBs) {
+                            tile->ref_mbs = ref_tile->mbs;
+                        }else
+                            av_log(0, AV_LOG_DEBUG, "Cannot use ref_tile, too few mbs\n");
                         ref_tile++;
                     }