[SCM] libav/experimental: Make TMV decoder check packet sizes before reading from it.

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit a2c4b2cc9a794006318d3d4c24c324bb7810f9d6
Author: Vitor Sessak <vitor1001 at gmail.com>
Date:   Sun May 17 09:48:12 2009 +0000

    Make TMV decoder check packet sizes before reading from it.
    
    FATE test 295 might need updating.
    
    Originally committed as revision 18862 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/tmv.c b/libavcodec/tmv.c
index 7bca086..5f746d5 100644
--- a/libavcodec/tmv.c
+++ b/libavcodec/tmv.c
@@ -52,6 +52,13 @@ static int tmv_decode_frame(AVCodecContext *avctx, void *data,
         return -1;
     }
 
+    if (avpkt->size < 2*char_rows*char_cols) {
+        av_log(avctx, AV_LOG_ERROR,
+               "Input buffer too small, truncated sample?\n");
+        *data_size = 0;
+        return -1;
+    }
+
     tmv->pic.pict_type = FF_I_TYPE;
     tmv->pic.key_frame = 1;
     dst                = tmv->pic.data[0];

-- 
Libav/FFmpeg packaging