From fa5292d9d42f10841e3a889bca4ebd878c965268 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Fri, 18 Nov 2011 18:08:31 +0100
Subject: [PATCH] vp3dec: Check coefficient index in vp3_dequant() Fixes
 NGS00145

Found-by: Phillip Langlois
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit eef5c35b4352ec49ca41f6198bee8a976b1f81e5)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/vp3.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 549f494ff6..2f07af8c4b 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -1308,6 +1308,10 @@ static inline int vp3_dequant(Vp3DecodeContext *s, Vp3Fragment *frag,
         case 1: // zero run
             s->dct_tokens[plane][i]++;
             i += (token >> 2) & 0x7f;
+            if(i>63){
+                av_log(s->avctx, AV_LOG_ERROR, "Coefficient index overflow\n");
+                return -1;
+            }
             block[perm[i]] = (token >> 9) * dequantizer[perm[i]];
             i++;
             break;