avcodec/indeo3: check that the VQ descriptor byte lies within the plane data

decode_cell() read the descriptor byte before comparing against last_ptr,
so a bit tree that ran out of data took the mode and VQ index of its last
cell from the byte after the plane.

That read is bounded: next_cell_data comes either from the bit position,
which the checked bit reader clamps to 8 bits past the end of the plane,
or from a completed cell, whose reads all lie before last_ptr. So the
descriptor is read at most 2 bytes past the plane, the plane ends at or
before the packet, and the read stays inside the packet padding. This is
not an out of array access, the cell was just decoded from a byte that
does not belong to its plane.

Found-by: zhang xingxing

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

libavcodec/indeo3.c

@@ -594,6 +594,11 @@ static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
     const vqEntry *delta[2];
     const uint8_t *data_start = data_ptr;
 
+    if (data_ptr >= last_ptr) {
+        av_log(avctx, AV_LOG_ERROR, "attempt to read past end of buffer\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* get coding mode and VQ table index from the VQ descriptor byte */
     code     = *data_ptr++;
     mode     = code >> 4;