virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/vmdvideo: Fix NULL + 0

Browse Source 
Affected the FATE tests filter-gradfun-sample and sierra-vmd-video.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 566bf56791)
This commit is contained in:
Andreas Rheinhardt 2021-03-26 15:12:10 +01:00 committed by Andreas Rheinhardt
parent 4eb44966a6
commit 6906a2b471
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libavcodec/vmdvideo.c
View File

@ -194,7 +194,7 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
unsigned char len; unsigned char len;
int ofs; int ofs;
int frame_x, frame_y; int frame_x, frame_y, prev_linesize;
int frame_width, frame_height; int frame_width, frame_height;
frame_x = AV_RL16(&s->buf[6]); frame_x = AV_RL16(&s->buf[6]);
@ -282,7 +282,13 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
} }
dp = &frame->data[0][frame_y * frame->linesize[0] + frame_x]; dp = &frame->data[0][frame_y * frame->linesize[0] + frame_x];
pp = &s->prev_frame->data[0][frame_y * s->prev_frame->linesize[0] + frame_x]; if (s->prev_frame->data[0]) {
prev_linesize = s->prev_frame->linesize[0];
pp = s->prev_frame->data[0] + frame_y * prev_linesize + frame_x;
} else {
pp = NULL;
prev_linesize = 0;
}
switch (meth) { switch (meth) {
case 1: case 1:
for (i = 0; i < frame_height; i++) { for (i = 0; i < frame_height; i++) {
@ -298,7 +304,7 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
ofs += len; ofs += len;
} else { } else {
/* interframe pixel copy */ /* interframe pixel copy */
if (ofs + len + 1 > frame_width || !s->prev_frame->data[0]) if (ofs + len + 1 > frame_width || !pp)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
memcpy(&dp[ofs], &pp[ofs], len + 1); memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1; ofs += len + 1;
@ -311,7 +317,7 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
dp += frame->linesize[0]; dp += frame->linesize[0];
pp += s->prev_frame->linesize[0]; pp = FF_PTR_ADD(pp, prev_linesize);
} }
break; break;
@ -319,7 +325,6 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
for (i = 0; i < frame_height; i++) { for (i = 0; i < frame_height; i++) {
bytestream2_get_buffer(&gb, dp, frame_width); bytestream2_get_buffer(&gb, dp, frame_width);
dp += frame->linesize[0]; dp += frame->linesize[0];
pp += s->prev_frame->linesize[0];
} }
break; break;
@ -347,7 +352,7 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
} }
} else { } else {
/* interframe pixel copy */ /* interframe pixel copy */
if (ofs + len + 1 > frame_width || !s->prev_frame->data[0]) if (ofs + len + 1 > frame_width || !pp)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
memcpy(&dp[ofs], &pp[ofs], len + 1); memcpy(&dp[ofs], &pp[ofs], len + 1);
ofs += len + 1; ofs += len + 1;
@ -360,7 +365,7 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
dp += frame->linesize[0]; dp += frame->linesize[0];
pp += s->prev_frame->linesize[0]; pp = FF_PTR_ADD(pp, prev_linesize);
} }
break; break;
} }