diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-19 14:46:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 00:35:12 +0100 |
| commit | d1da1c8384c625f2ecb0040c60702ebb5523a0d1 (patch) | |
| tree | 07c1dd00742ea07bdb99af7702c4b4bafa243f20 | |
| parent | 8ded3738d15c9fb83906a5c1a5a04925130edc1f (diff) | |
| download | ffmpeg-d1da1c8384c625f2ecb0040c60702ebb5523a0d1.tar.gz | |
avcodec/mpegvideo_motion: Use a field from the current frame if the last is unavailable in DMV & 16x8
Fixes null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 42bcc4082d644342171216fcf597cde75421a4d7)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/mpegvideo_motion.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/mpegvideo_motion.c b/libavcodec/mpegvideo_motion.c index f443b8e629..6fddab7705 100644 --- a/libavcodec/mpegvideo_motion.c +++ b/libavcodec/mpegvideo_motion.c @@ -827,8 +827,8 @@ static av_always_inline void MPV_motion_internal(MpegEncContext *s, for(i=0; i<2; i++){ uint8_t ** ref2picture; - if(s->picture_structure == s->field_select[dir][i] + 1 - || s->pict_type == AV_PICTURE_TYPE_B || s->first_field){ + if((s->picture_structure == s->field_select[dir][i] + 1 + || s->pict_type == AV_PICTURE_TYPE_B || s->first_field) && ref_picture[0]){ ref2picture= ref_picture; }else{ ref2picture = s->current_picture_ptr->f.data; @@ -857,6 +857,9 @@ static av_always_inline void MPV_motion_internal(MpegEncContext *s, pix_op = s->dsp.avg_pixels_tab; } }else{ + if (!ref_picture[0]) { + ref_picture = s->current_picture_ptr->f.data; + } for(i=0; i<2; i++){ mpeg_motion(s, dest_y, dest_cb, dest_cr, s->picture_structure != i+1, |