virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/vc1dec: field pictures with direct mode MBs, followed by frame pictures are not supported

Browse Source 
This case could occur when cuting and concatenating bitstreams

Fixes out of array read
Fixes: asan_heap-oob_1b33fdd_2849_cov_478905890_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-02-01 05:34:25 +01:00
parent dce93218d7
commit 85d51d8e32
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/vc1dec.c
View File

@ -4342,6 +4342,10 @@ static void vc1_decode_b_mb_intfi(VC1Context *v)
if (bmvtype == BMV_TYPE_DIRECT) {
dmv_x[0] = dmv_y[0] = pred_flag[0] = 0;
dmv_x[1] = dmv_y[1] = pred_flag[0] = 0;
if (!s->next_picture_ptr->field_picture) {
av_log(s->avctx, AV_LOG_ERROR, "Mixed field/frame direct mode not supported\n");
return;
}
}
vc1_pred_b_mv_intfi(v, 0, dmv_x, dmv_y, 1, pred_flag);
vc1_b_mc(v, dmv_x, dmv_y, (bmvtype == BMV_TYPE_DIRECT), bmvtype);
@ -6014,6 +6018,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
goto err;
}
v->s.current_picture_ptr->field_picture = v->field_mode;
v->s.current_picture_ptr->f.interlaced_frame = (v->fcm != PROGRESSIVE);
v->s.current_picture_ptr->f.top_field_first = v->tff;