Merge commit '25a6666f6c07c6ac8449a63d7fbce0dfd29c54cd'

* commit '25a6666f6c07c6ac8449a63d7fbce0dfd29c54cd':
  indeo: Bound-check before applying motion compensation

The added checks and one previously added check are replaced by asserts,
the conditions can only be
true when vectors are invalid or there are worse inconsistencies.
We are checking the vectors validity and there should be no
inconsistencies, thus the checks should not be needed.
Also no files are known to cause any anomalies in ffmpeg

Merged-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/ivi_common.c

@@ -44,16 +44,19 @@ static VLC ivi_blk_vlc_tabs[8]; ///< static block Huffman tables
 typedef void (*ivi_mc_func) (int16_t *buf, const int16_t *ref_buf,
                              uint32_t pitch, int mc_type);
 
-static int ivi_mc(ivi_mc_func mc, int16_t *buf, const int16_t *ref_buf,
-                  int offs, int mv_x, int mv_y, uint32_t pitch,
-                  int mc_type)
+static int ivi_mc(IVIBandDesc *band, ivi_mc_func mc,
+                  int offs, int mv_x, int mv_y, int mc_type)
 {
-    int ref_offs = offs + mv_y * pitch + mv_x;
+    int ref_offs = offs + mv_y * band->pitch + mv_x;
+    int buf_size = band->pitch * band->aheight;
+    int min_size = band->pitch * (band->blk_size - 1) + band->blk_size;
+    int ref_size = (mc_type > 1) * band->pitch + (mc_type & 1);
 
-    if (offs < 0 || ref_offs < 0 || !ref_buf)
-        return AVERROR_INVALIDDATA;
+    av_assert0(offs >= 0 && ref_offs >= 0 && band->ref_buf);
+    av_assert0(buf_size - min_size >= offs);
+    av_assert0(buf_size - min_size - ref_size >= ref_offs);
 
-    mc(buf + offs, ref_buf + ref_offs, pitch, mc_type);
+    mc(band->buf + offs, band->ref_buf + ref_offs, band->pitch, mc_type);
 
     return 0;
 }
@@ -522,8 +525,7 @@ static int ivi_decode_coded_blocks(GetBitContext *gb, IVIBandDesc *band,
 
     /* apply motion compensation */
     if (!is_intra)
-        return ivi_mc(mc, band->buf, band->ref_buf, offs, mv_x, mv_y,
-                      band->pitch, mc_type);
+        return ivi_mc(band, mc, offs, mv_x, mv_y, mc_type);
 
     return 0;
 }
@@ -626,8 +628,8 @@ static int ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band,
                     if (ret < 0)
                         return ret;
                 } else {
-                    ret = ivi_mc(mc_no_delta_func, band->buf, band->ref_buf,
-                                 buf_offs, mv_x, mv_y, band->pitch, mc_type);
+                    ret = ivi_mc(band, mc_no_delta_func, buf_offs,
+                                 mv_x, mv_y, mc_type);
                     if (ret < 0)
                         return ret;
                 }
@@ -749,8 +751,8 @@ static int ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
             for (blk = 0; blk < num_blocks; blk++) {
                 /* adjust block position in the buffer according with its number */
                 offs = mb->buf_offs + band->blk_size * ((blk & 1) + !!(blk & 2) * band->pitch);
-                ret = ivi_mc(mc_no_delta_func, band->buf, band->ref_buf,
-                             offs, mv_x, mv_y, band->pitch, mc_type);
+                ret = ivi_mc(band, mc_no_delta_func, offs,
+                             mv_x, mv_y, mc_type);
                 if (ret < 0)
                     return ret;
             }