diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-25 00:41:16 +0100 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-25 03:30:04 +0100 |
commit | e9d443cf08503f7bd0149576ba9e891322de340d (patch) | |
tree | f4cb09b5d9fd93d23466852af25e1cf0c97e4678 | |
parent | 286930d302fd34cfc2541bfdd760a8bbf9f2d2e5 (diff) | |
download | ffmpeg-e9d443cf08503f7bd0149576ba9e891322de340d.tar.gz |
eacmv: Free frames on resolution changes
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavcodec/eacmv.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c index a129161386..33c614588d 100644 --- a/libavcodec/eacmv.c +++ b/libavcodec/eacmv.c @@ -132,8 +132,13 @@ static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t s->width = AV_RL16(&buf[4]); s->height = AV_RL16(&buf[6]); - if (s->avctx->width!=s->width || s->avctx->height!=s->height) + if (s->avctx->width!=s->width || s->avctx->height!=s->height) { avcodec_set_dimensions(s->avctx, s->width, s->height); + if (s->frame.data[0]) + s->avctx->release_buffer(s->avctx, &s->frame); + if (s->last_frame.data[0]) + s->avctx->release_buffer(s->avctx, &s->last_frame); + } s->avctx->time_base.num = 1; s->avctx->time_base.den = AV_RL16(&buf[10]); |