@@ -343,6 +343,10 @@ static void decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int lo

         decode_p_block(f, dst             , src             , log2w, log2h, stride);

         decode_p_block(f, dst + (1<<log2w), src + (1<<log2w), log2w, log2h, stride);

     }else if(code == 3 && f->version<2){

+        if (start > src || src > end) {

+            av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");

+            return;

+        }

         mcdc(dst, src, log2w, h, stride, 1, 0);

     }else if(code == 4){

         src += f->mv[bytestream2_get_byte(&f->g)];

@@ -352,6 +356,10 @@ static void decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, int lo

         }

         mcdc(dst, src, log2w, h, stride, 1, bytestream2_get_le16(&f->g2));

     }else if(code == 5){

+        if (start > src || src > end) {

+            av_log(f->avctx, AV_LOG_ERROR, "mv out of pic\n");

+            return;

+        }

         mcdc(dst, src, log2w, h, stride, 0, bytestream2_get_le16(&f->g2));

     }else if(code == 6){

         if(log2w){