ffmpeg roll of source to mar 9 version...

patched-ffmpeg-mt/libavcodec/flashsv.c

 /*
  * Flash Screen Video decoder
  * Copyright (C) 2004 Alex Beregszaszi
  * Copyright (C) 2006 Benjamin Larsson
  *
  * This file is part of FFmpeg.
  *
  * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
@@ skipping 95 matching lines @@
 {
     const uint8_t *buf = avpkt->data;
     int buf_size = avpkt->size;
     FlashSVContext *s = avctx->priv_data;
     int h_blocks, v_blocks, h_part, v_part, i, j;
     GetBitContext gb;
 
     /* no supplementary picture */
     if (buf_size == 0)
         return 0;
+    if (buf_size < 4)
+        return -1;
 
     init_get_bits(&gb, buf, buf_size * 8);
 
     /* start to parse the bitstream */
     s->block_width = 16* (get_bits(&gb, 4)+1);
     s->image_width =     get_bits(&gb,12);
     s->block_height= 16* (get_bits(&gb, 4)+1);
     s->image_height=     get_bits(&gb,12);
 
     /* calculate amount of blocks and the size of the border blocks */
@@ skipping 48 matching lines @@
 
 
         /* loop over all block rows */
         for (i = 0; i < h_blocks + (h_part?1:0); i++)
         {
             int wp = i*s->block_width; // vert position in frame
             int ws = (i<h_blocks)?s->block_width:h_part; // size of block
 
             /* get the size of the compressed zlib chunk */
             int size = get_bits(&gb, 16);
+            if (8 * size > get_bits_left(&gb)) {
+                avctx->release_buffer(avctx, &s->frame);
+                s->frame.data[0] = NULL;
+                return -1;
+            }
 
             if (size == 0) {
                 /* no change, don't do anything */
             } else {
                 /* decompress block */
                 int ret = inflateReset(&(s->zstream));
                 if (ret != Z_OK)
                 {
                     av_log(avctx, AV_LOG_ERROR, "error in decompression (reset) of block %dx%d\n", i, j);
                     /* return -1; */
@@ skipping 55 matching lines @@
     CODEC_ID_FLASHSV,
     sizeof(FlashSVContext),
     flashsv_decode_init,
     NULL,
     flashsv_decode_end,
     flashsv_decode_frame,
     CODEC_CAP_DR1,
     .pix_fmts = (const enum PixelFormat[]){PIX_FMT_BGR24, PIX_FMT_NONE},
     .long_name = NULL_IF_CONFIG_SMALL("Flash Screen Video v1"),
 };