Merge commit '68a35473ed423a14731c418939fba7913647979a'

* commit '68a35473ed423a14731c418939fba7913647979a':
  4xm: more thorought check for negative index and negative shift

Conflicts:
	libavcodec/4xm.c

Mostly not merged, the added checks, check for impossible conditions
for paranoias sake they are replaced by asserts but thats probably overkill
the vlc table does not contain out of range values or holes,
nor does it permit the log2 values to become negative. Whenever a
log2 value reaches 0 the selected table no longer contains an entry to trigger
the case that would decrease it further

Adding such impossible checks would confuse the reader

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 14 insertions, 10 deletions

diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index ff1008200d..7c5e2fdf87 100644
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -342,18 +342,22 @@ static inline void mcdc(uint16_t *dst, const uint16_t *src, int log2w,
 static int decode_p_block(FourXContext *f, uint16_t *dst, const uint16_t *src,
                           int log2w, int log2h, int stride)
 {
-    const int index = size2index[log2h][log2w];
-    const int h     = 1 << log2h;
-    int code        = get_vlc2(&f->gb,
-                               block_type_vlc[1 - (f->version > 1)][index].table,
-                               BLOCK_TYPE_VLC_BITS, 1);
-    uint16_t *start = f->last_frame_buffer;
-    uint16_t *end   = start + stride * (f->avctx->height - h + 1) - (1 << log2w);
-    int ret;
-    int scale   = 1;
+    int index, h, code, ret, scale = 1;
+    uint16_t *start, *end;
     unsigned dc = 0;
 
-    av_assert0(code >= 0 && code <= 6 && log2w >= 0);
+    av_assert0(code >= 0 && code <= 6 && log2w >= 0 && log2h >= 0);
+
+    index = size2index[log2h][log2w];
+    av_assert0(index >= 0);
+
+    h     = 1 << log2h;
+    code  = get_vlc2(&f->gb, block_type_vlc[1 - (f->version > 1)][index].table,
+                     BLOCK_TYPE_VLC_BITS, 1);
+    av_assert0(code >= 0 && code <= 6);
+
+    start = f->last_frame_buffer;
+    end   = start + stride * (f->avctx->height - h + 1) - (1 << log2w);
 
     if (code == 1) {
         log2h--;