diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-02-01 05:34:25 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-02-23 14:43:52 +0100 |
| commit | 9368b91834e46149f6b97ba3dd3648e3f79edef2 (patch) | |
| tree | 8f9fe132d4278bf61bdca533f124444eccf235ad /libavcodec | |
| parent | f22e88c17772b253ad08de15e8beb922791d488e (diff) | |
| download | ffmpeg-9368b91834e46149f6b97ba3dd3648e3f79edef2.tar.gz | |
avcodec/vc1dec: field pictures with direct mode MBs, followed by frame pictures are not supported
This case could occur when cuting and concatenating bitstreams
Fixes out of array read
Fixes: asan_heap-oob_1b33fdd_2849_cov_478905890_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 85d51d8e327c666ac963acf25cf6a6763e6c6671)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/vc1dec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 2604a95174..018f1d997c 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -4342,6 +4342,10 @@ static void vc1_decode_b_mb_intfi(VC1Context *v) if (bmvtype == BMV_TYPE_DIRECT) { dmv_x[0] = dmv_y[0] = pred_flag[0] = 0; dmv_x[1] = dmv_y[1] = pred_flag[0] = 0; + if (!s->next_picture_ptr->field_picture) { + av_log(s->avctx, AV_LOG_ERROR, "Mixed field/frame direct mode not supported\n"); + return; + } } vc1_pred_b_mv_intfi(v, 0, dmv_x, dmv_y, 1, pred_flag); vc1_b_mc(v, dmv_x, dmv_y, (bmvtype == BMV_TYPE_DIRECT), bmvtype); @@ -6028,6 +6032,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, goto err; } + v->s.current_picture_ptr->field_picture = v->field_mode; v->s.current_picture_ptr->f.interlaced_frame = (v->fcm != PROGRESSIVE); v->s.current_picture_ptr->f.top_field_first = v->tff; |