ffmpeg roll of source to mar 9 version...

patched-ffmpeg-mt/libavcodec/eatgv.c

 /*
  * Electronic Arts TGV Video Decoder
  * Copyright (c) 2007-2008 Peter Ross
  *
  * This file is part of FFmpeg.
  *
  * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
@@ skipping 174 matching lines @@
     /* read compressed blocks */
     init_get_bits(&gb, buf, (buf_end-buf)<<3);
     for (i=0; i<num_blocks_packed; i++) {
         int tmp[4];
         for(j=0; j<4; j++)
             tmp[j] = get_bits(&gb, 8);
         for(j=0; j<16; j++)
             s->block_codebook[i][15-j] = tmp[get_bits(&gb, 2)];
     }
 
+    if (get_bits_left(&gb) < vector_bits *
+        (s->avctx->height/4) * (s->avctx->width/4))
+        return -1;
+
     /* read vectors and build frame */
     for(y=0; y<s->avctx->height/4; y++)
     for(x=0; x<s->avctx->width/4; x++) {
         unsigned int vector = get_bits(&gb, vector_bits);
         const unsigned char *src;
         int src_stride;
 
         if (vector < num_mvs) {
             src = s->last_frame.data[0] +
                   (y*4 + s->mv_codebook[vector][1])*s->last_frame.linesize[0] +
@@ skipping 128 matching lines @@
     "eatgv",
     CODEC_TYPE_VIDEO,
     CODEC_ID_TGV,
     sizeof(TgvContext),
     tgv_decode_init,
     NULL,
     tgv_decode_end,
     tgv_decode_frame,
     .long_name = NULL_IF_CONFIG_SMALL("Electronic Arts TGV video"),
 };