perform height sanity check in mmvideo decoder

Fixes issue2495
Original patch by Daniel Kang, daniel.d.kang at gmail

Originally committed as revision 26300 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/mmvideo.c

@@ -90,6 +90,9 @@ static void mm_decode_intra(MmContext * s, int half_horiz, int half_vert, const
     while(i<buf_size) {
         int run_length, color;
 
+        if (y >= s->avctx->height)
+            return;
+
         if (buf[i] & 0x80) {
             run_length = 1;
             color = buf[i];
@@ -138,6 +141,9 @@ static void mm_decode_inter(MmContext * s, int half_horiz, int half_vert, const
             continue;
         }
 
+        if (y + half_vert >= s->avctx->height)
+            return;
+
         for(i=0; i<length; i++) {
             for(j=0; j<8; j++) {
                 int replace = (buf[r+i] >> (7-j)) & 1;