diff options
author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-06-24 01:38:17 +0200 |
---|---|---|
committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-06-30 11:34:36 +0200 |
commit | 5a30b45c0fe4abaaf69ca8e465bf8113fee23626 (patch) | |
tree | 3c5ed43bfe7a2b5add113aafe3b26405461e3cd5 /libavcodec/rl2.c | |
parent | f26255962c1dd516c6fc0a25e460ad538fa21ff6 (diff) | |
download | ffmpeg-5a30b45c0fe4abaaf69ca8e465bf8113fee23626.tar.gz |
avcodec/mpeg12dec: Don't adapt (last|next)_pic.linesize for field pics
These values are not read anywhere. Furthermore, since commit
fe6037fd04db8837dcdb9013f9c4ad4e7eb0592e the linesize values
of the MPVWorkPictures were wrong for subsequent fields
in a chain of B-pictures (as they are always doubled and no longer
based upon the frame-linesizes) which can eventually lead to overflow.
Finally, it makes no real sense to ever double the linesize
of the reference pictures at all: Even when the current picture
is a field, it can still reference both fields of reference
pictures and therefore the linesize should allow to address
both fields (for the same reason, data is not offset for
reference pictures).
libavcodec/mpeg12dec.c:1304:41: runtime error: signed integer overflow: 4611686018427387904 * 2 cannot be represented in type 'long'
issue: 69732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEGVIDEO_fuzzer-5123551179374592
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavcodec/rl2.c')
0 files changed, 0 insertions, 0 deletions