From: Markus Koschany <apo@debian.org>
Date: Sun, 30 Dec 2018 16:14:54 +0000 (+0100)
Subject: CVE-2017-17130
X-Git-Tag: archive/raspbian/6%11.12-1_deb8u8+rpi1^2~30
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=4cbbf28366a71bf8609ae69c9fb84f8448d6627c;p=libav.git

CVE-2017-17130

Origin: https://github.com/libav/libav/commit/49cf72b3ac77140cf4715c18fe7c7610d918d912

Gbp-Pq: Name CVE-2017-17130.patch
---

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index cbaae33..2032b46 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -5844,7 +5844,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
                                   buf_size3 << 3);
                     /* assuming that the field marker is at the exact middle,
                        hope it's correct */
-                    slices[n_slices].mby_start = s->mb_height >> 1;
+                    slices[n_slices].mby_start = s->mb_height + 1 >> 1;
                     n_slices1 = n_slices - 1; // index of the last slice of the first field
                     n_slices++;
                     break;
@@ -5892,7 +5892,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
                 buf_size3 = vc1_unescape_buffer(divider + 4, buf + buf_size - divider - 4, slices[n_slices].buf);
                 init_get_bits(&slices[n_slices].gb, slices[n_slices].buf,
                               buf_size3 << 3);
-                slices[n_slices].mby_start = s->mb_height >> 1;
+                slices[n_slices].mby_start = s->mb_height + 1 >> 1;
                 n_slices1 = n_slices - 1;
                 n_slices++;
             }