commit 5d6982c13bba56115125de68969f46906038b73e
author Michael Niedermayer <michaelni@gmx.at> Sat Mar 31 21:42:50 2012 +0200
committer Michael Niedermayer <michaelni@gmx.at> Thu May 03 01:31:07 2012 +0200
tree 2d9dc015487e936aed4e4c8db2ad2996299ee28d
parent e11fa0879a66d4e9c0258b6232a8f59121308d0c

indeo4: check that num_mbs matches

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d3db8988d5befd8702a748cf1957415677bfe75c)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/indeo4.c

diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c
index 9ce701b..6763af4 100644
--- a/libavcodec/indeo4.c
+++ b/libavcodec/indeo4.c
@@ -473,6 +473,11 @@
     mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
     mv_x = mv_y = 0;
 
+    if (((tile->width + band->mb_size-1)/band->mb_size) * ((tile->height + band->mb_size-1)/band->mb_size) != tile->num_MBs) {
+        av_log(avctx, AV_LOG_ERROR, "num_MBs mismatch %d %d %d %d\n", tile->width, tile->height, band->mb_size, tile->num_MBs);
+        return -1;
+    }
+
     for (y = tile->ypos; y < tile->ypos + tile->height; y += band->mb_size) {
         mb_offset = offs;