|
|
@@ -361,14 +361,16 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext *ctx, GetBitContext *g |
|
|
|
int shift_y = 16 - ctx->sprite_shift[0]; |
|
|
|
int shift_c = 16 - ctx->sprite_shift[1]; |
|
|
|
|
|
|
|
if (shift_c < 0 || shift_y < 0 || |
|
|
|
FFABS(sprite_offset[0][0]) >= INT_MAX >> shift_y || |
|
|
|
FFABS(sprite_offset[1][0]) >= INT_MAX >> shift_c || |
|
|
|
FFABS(sprite_offset[0][1]) >= INT_MAX >> shift_y || |
|
|
|
FFABS(sprite_offset[1][1]) >= INT_MAX >> shift_c |
|
|
|
) { |
|
|
|
avpriv_request_sample(s->avctx, "Too large sprite shift or offset"); |
|
|
|
goto overflow; |
|
|
|
for (i = 0; i < 2; i++) { |
|
|
|
if (shift_c < 0 || shift_y < 0 || |
|
|
|
FFABS( sprite_offset[0][i]) >= INT_MAX >> shift_y || |
|
|
|
FFABS( sprite_offset[1][i]) >= INT_MAX >> shift_c || |
|
|
|
FFABS(s->sprite_delta[0][i]) >= INT_MAX >> shift_y || |
|
|
|
FFABS(s->sprite_delta[1][i]) >= INT_MAX >> shift_y |
|
|
|
) { |
|
|
|
avpriv_request_sample(s->avctx, "Too large sprite shift, delta or offset"); |
|
|
|
goto overflow; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
for (i = 0; i < 2; i++) { |
|
|
|