diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-27 22:15:31 +0000 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2011-10-07 16:25:31 +0200 |
| commit | c7e631986b4a326a71a20a1a51000f3fbf6e64e7 (patch) | |
| tree | 77a32ef5113fee099c5e59cd3b1aedc841027840 | |
| parent | 2c6cf1394096d08396faadc6e7c0b404fd6df006 (diff) | |
| download | ffmpeg-c7e631986b4a326a71a20a1a51000f3fbf6e64e7.tar.gz | |
bink: Prevent NULL dereferences with missing reference frame
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
| -rw-r--r-- | libavcodec/bink.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libavcodec/bink.c b/libavcodec/bink.c index 17683730d4..e4fdf4c93e 100644 --- a/libavcodec/bink.c +++ b/libavcodec/bink.c @@ -950,8 +950,9 @@ static int bink_decode_plane(BinkContext *c, GetBitContext *gb, int plane_idx, for (i = 0; i < BINK_NB_SRC; i++) read_bundle(gb, c, i); - ref_start = c->last.data[plane_idx]; - ref_end = c->last.data[plane_idx] + ref_start = c->last.data[plane_idx] ? c->last.data[plane_idx] + : c->pic.data[plane_idx]; + ref_end = ref_start + (bw - 1 + c->last.linesize[plane_idx] * (bh - 1)) * 8; for (i = 0; i < 64; i++) @@ -980,7 +981,8 @@ static int bink_decode_plane(BinkContext *c, GetBitContext *gb, int plane_idx, if (by == bh) break; dst = c->pic.data[plane_idx] + 8*by*stride; - prev = c->last.data[plane_idx] + 8*by*stride; + prev = (c->last.data[plane_idx] ? c->last.data[plane_idx] + : c->pic.data[plane_idx]) + 8*by*stride; for (bx = 0; bx < bw; bx++, dst += 8, prev += 8) { blk = get_value(c, BINK_SRC_BLOCK_TYPES); // 16x16 block type on odd line means part of the already decoded block, so skip it |