From cf8fefc71ef79815969fd34d21d4f05247b576a9 Mon Sep 17 00:00:00 2001
From: Daniel Kang <daniel.d.kang@gmail.com>
Date: Wed, 5 Jan 2011 19:31:09 -0500
Subject: [PATCH] Add sanity check on height with mm video.

---
 libavcodec/mmvideo.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/libavcodec/mmvideo.c b/libavcodec/mmvideo.c
index 6dbc0c4..38da24b 100644
--- a/libavcodec/mmvideo.c
+++ b/libavcodec/mmvideo.c
@@ -85,6 +85,10 @@ static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const

     while(i<buf_size) {
         int run_length, color;
+        if (y >= s->avctx->height) {
+            av_log(s->avctx, AV_LOG_WARNING, "Warning, height exceeded while decoding\n");
+            return;
+        }

         if (buf[i] & 0x80) {
             run_length = 1;
@@ -130,6 +134,11 @@ static void mm_decode_inter(MmContext * s, int half_horiz, int half_vert, const
             continue;
         }

+        if (y >= s->avctx->height || (half_vert && ((y+1) >= s->avctx->height))) {
+            av_log(s->avctx, AV_LOG_WARNING, "Warning, height exceeded while decoding\n");
+            return;
+        }
+
         for(i=0; i<length; i++) {
             for(j=0; j<8; j++) {
                 int replace = (buf[r+i] >> (7-j)) & 1;
--
1.7.2.2