diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-31 00:45:24 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-31 00:46:04 +0100 |
| commit | 9df9420dea0fc4c523dabc1bb6186c98885bdd9f (patch) | |
| tree | 5b9949a777c65303d4244f6a7d25664abeea93c8 /libavcodec/interplayvideo.c | |
| parent | 9c50e69385e88ec632adf90ea2dd66fe2f24feb2 (diff) | |
interplayvideo: Free previous frames on resolution changes.
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/interplayvideo.c')
| -rw-r--r-- | libavcodec/interplayvideo.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c index 3285578a70..e0550a702b 100644 --- a/libavcodec/interplayvideo.c +++ b/libavcodec/interplayvideo.c @@ -969,6 +969,13 @@ static int ipvideo_decode_frame(AVCodecContext *avctx, if (buf_size < s->decoding_map_size) return buf_size; + if (s->last_frame.data[0] && av_packet_get_side_data(avpkt, AV_PKT_DATA_PARAM_CHANGE, NULL)) { + if (s->last_frame.data[0]) + avctx->release_buffer(avctx, &s->last_frame); + if (s->second_last_frame.data[0]) + avctx->release_buffer(avctx, &s->second_last_frame); + } + s->decoding_map = buf; bytestream2_init(&s->stream_ptr, buf + s->decoding_map_size, buf_size - s->decoding_map_size); |