diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-04 01:11:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-04 01:19:48 +0200 |
| commit | 64819bfc7a1f622eab88c8962e02c9e2941bb42d (patch) | |
| tree | 8a3167e4920050873a6304f9c6c11d58e7a6e669 | |
| parent | e756635964ed3aa1ee997465f9b46143bcb5d894 (diff) | |
| download | ffmpeg-64819bfc7a1f622eab88c8962e02c9e2941bb42d.tar.gz | |
snow: Fix off by 1 error in reference picture management
Fixes out of array accesses
No release is affected by this bug
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/snow.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/snow.c b/libavcodec/snow.c index 9f6399c78a..5362ae4d5e 100644 --- a/libavcodec/snow.c +++ b/libavcodec/snow.c @@ -618,7 +618,7 @@ int ff_snow_frame_start(SnowContext *s){ av_frame_move_ref(&tmp, &s->last_picture[s->max_ref_frames-1]); for(i=s->max_ref_frames-1; i>0; i--) - av_frame_move_ref(&s->last_picture[i+1], &s->last_picture[i]); + av_frame_move_ref(&s->last_picture[i], &s->last_picture[i-1]); memmove(s->halfpel_plane+1, s->halfpel_plane, (s->max_ref_frames-1)*sizeof(void*)*4*4); if(USE_HALFPEL_PLANE && s->current_picture.data[0]) halfpel_interpol(s, s->halfpel_plane[0], &s->current_picture); |