diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-13 00:21:59 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-13 00:22:24 +0100 |
| commit | e9cb533fbb90c274cfed07b69ebf5c1989573e20 (patch) | |
| tree | 0b34fb1b707088383e7153ee11d0fc18a931cd69 /libavcodec/flashsv.c | |
| parent | 4b2f696d6e502c46e91dfe184c7b745f78b35a03 (diff) | |
flashv: check if keyframe is available, fix null deref.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/flashsv.c')
| -rw-r--r-- | libavcodec/flashsv.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/flashsv.c b/libavcodec/flashsv.c index 643dab334a..14c514c361 100644 --- a/libavcodec/flashsv.c +++ b/libavcodec/flashsv.c @@ -406,6 +406,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data, int k; int off = (s->image_height - y_pos - 1) * s->frame.linesize[0]; + if (!s->keyframe) { + av_log(avctx, AV_LOG_ERROR, "no keyframe yet\n"); + return AVERROR_INVALIDDATA; + } for (k = 0; k < cur_blk_height; k++) memcpy(s->frame.data[0] + off - k*s->frame.linesize[0] + x_pos*3, s->keyframe + off - k*s->frame.linesize[0] + x_pos*3, |