diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-04 01:06:51 +0100 |
|---|---|---|
| committer | Vittorio Giovara <vittorio.giovara@gmail.com> | 2014-08-08 15:04:18 +0100 |
| commit | dcc68de942f06d358192a57057adb133f7c40dd7 (patch) | |
| tree | f24bfd31338f3340dbc8279a74acdeb0b0d4b342 | |
| parent | ebe2292eafa7cac71dcdddb865e18c05635fe117 (diff) | |
| download | ffmpeg-dcc68de942f06d358192a57057adb133f7c40dd7.tar.gz | |
vp3: Copy all 3 frames for thread updates
Fixes a double release of the current frame on deinit.
Bug-Id: CVE-2011-3934
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
| -rw-r--r-- | libavcodec/vp3.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c index d8e16505a1..2fa10c1e1b 100644 --- a/libavcodec/vp3.c +++ b/libavcodec/vp3.c @@ -1865,7 +1865,7 @@ static int vp3_update_thread_context(AVCodecContext *dst, const AVCodecContext * ||s->width != s1->width ||s->height!= s1->height) { if (s != s1) - copy_fields(s, s1, golden_frame, current_frame); + copy_fields(s, s1, golden_frame, keyframe); return -1; } |