diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-16 03:48:15 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-16 07:58:46 +0400 |
| commit | 7845f8d282a98d5e01aaeddfa9af698697d8874d (patch) | |
| tree | 92c76e7576032e6dc4f5849e18278b855e2ab1fc /libavcodec/vc1dec.c | |
| parent | 8f42b09604a6751eb3d3c225b8270b708a8338f4 (diff) | |
vc1dec: do not allow field_mode to change after the first header
Fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vc1dec.c')
| -rw-r--r-- | libavcodec/vc1dec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 8fbdbdf2cb..b6d59c9948 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5516,6 +5516,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, // do parse frame header v->pic_header_flag = 0; + v->first_pic_header_flag = 1; if (v->profile < PROFILE_ADVANCED) { if (ff_vc1_parse_frame_header(v, &s->gb) < 0) { goto err; @@ -5525,6 +5526,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, goto err; } } + v->first_pic_header_flag = 0; if (avctx->debug & FF_DEBUG_PICT_INFO) av_log(v->s.avctx, AV_LOG_DEBUG, "pict_type: %c\n", av_get_picture_type_char(s->pict_type)); |