From 09de0ffeab37442d1a31ee194ea6d78a67186de1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 5 Dec 2012 05:47:37 +0100 Subject: [PATCH] vc1dec: Fix null pointer dereference in vc1_decode_skip_blocks() This handles the last frame being unavailable like all the other code in vc1dec. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/vc1dec.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index f5c532985c..9e0e098aab 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -4745,9 +4745,11 @@ static void vc1_decode_skip_blocks(VC1Context *v) s->mb_x = 0; ff_init_block_index(s); ff_update_block_index(s); - memcpy(s->dest[0], s->last_picture.f.data[0] + s->mb_y * 16 * s->linesize, s->linesize * 16); - memcpy(s->dest[1], s->last_picture.f.data[1] + s->mb_y * 8 * s->uvlinesize, s->uvlinesize * 8); - memcpy(s->dest[2], s->last_picture.f.data[2] + s->mb_y * 8 * s->uvlinesize, s->uvlinesize * 8); + if (s->last_picture.f.data[0]) { + memcpy(s->dest[0], s->last_picture.f.data[0] + s->mb_y * 16 * s->linesize, s->linesize * 16); + memcpy(s->dest[1], s->last_picture.f.data[1] + s->mb_y * 8 * s->uvlinesize, s->uvlinesize * 8); + memcpy(s->dest[2], s->last_picture.f.data[2] + s->mb_y * 8 * s->uvlinesize, s->uvlinesize * 8); + } ff_draw_horiz_band(s, s->mb_y * 16, 16); s->first_slice_line = 0; }