| 
																	
																	
																		
																	
																	
																 | 
																@@ -389,7 +389,10 @@ static int mpeg4_decode_sprite_trajectory(Mpeg4DecContext *ctx, GetBitContext *g | 
															
														
														
													
														
															
																 | 
																 | 
																        for (i = 0; i < 2; i++) { | 
																 | 
																 | 
																        for (i = 0; i < 2; i++) { | 
															
														
														
													
														
															
																 | 
																 | 
																            if (llabs(s->sprite_offset[0][i] + s->sprite_delta[i][0] * (w+16LL)) >= INT_MAX || | 
																 | 
																 | 
																            if (llabs(s->sprite_offset[0][i] + s->sprite_delta[i][0] * (w+16LL)) >= INT_MAX || | 
															
														
														
													
														
															
																 | 
																 | 
																                llabs(s->sprite_offset[0][i] + s->sprite_delta[i][1] * (h+16LL)) >= INT_MAX || | 
																 | 
																 | 
																                llabs(s->sprite_offset[0][i] + s->sprite_delta[i][1] * (h+16LL)) >= INT_MAX || | 
															
														
														
													
														
															
																 | 
																 | 
																                llabs(s->sprite_offset[0][i] + s->sprite_delta[i][0] * (w+16LL) + s->sprite_delta[i][1] * (h+16LL)) >= INT_MAX) { | 
																 | 
																 | 
																 | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																                llabs(s->sprite_offset[0][i] + s->sprite_delta[i][0] * (w+16LL) + s->sprite_delta[i][1] * (h+16LL)) >= INT_MAX || | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																                llabs(s->sprite_delta[i][0] * (w+16LL)) >= INT_MAX || | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																                llabs(s->sprite_delta[i][1] * (w+16LL)) >= INT_MAX | 
															
														
														
													
														
															
																 | 
																 | 
																 | 
																 | 
																 | 
																            ) { | 
															
														
														
													
														
															
																 | 
																 | 
																                avpriv_request_sample(s->avctx, "Overflow on sprite points"); | 
																 | 
																 | 
																                avpriv_request_sample(s->avctx, "Overflow on sprite points"); | 
															
														
														
													
														
															
																 | 
																 | 
																                goto overflow; | 
																 | 
																 | 
																                goto overflow; | 
															
														
														
													
														
															
																 | 
																 | 
																            } | 
																 | 
																 | 
																            } | 
															
														
														
													
												
													
														
															
																| 
																	
																		
																	
																	
																	
																 | 
																
  |