diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-19 14:46:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-04-19 14:48:01 +0200 |
| commit | 42bcc4082d644342171216fcf597cde75421a4d7 (patch) | |
| tree | 6a947626622ff280854cdbe158d8c8ca76d863d0 /libavcodec/mpegvideo_motion.c | |
| parent | 30e6a02c23ee03c3ce8e70cb377bbff147537d23 (diff) | |
avcodec/mpegvideo_motion: Use a field from the current frame if the last is unavailable in DMV & 16x8
Fixes null pointer dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mpegvideo_motion.c')
| -rw-r--r-- | libavcodec/mpegvideo_motion.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/mpegvideo_motion.c b/libavcodec/mpegvideo_motion.c index 225e9a637f..96b37800d8 100644 --- a/libavcodec/mpegvideo_motion.c +++ b/libavcodec/mpegvideo_motion.c @@ -824,8 +824,8 @@ static av_always_inline void MPV_motion_internal(MpegEncContext *s, for(i=0; i<2; i++){ uint8_t ** ref2picture; - if(s->picture_structure == s->field_select[dir][i] + 1 - || s->pict_type == AV_PICTURE_TYPE_B || s->first_field){ + if((s->picture_structure == s->field_select[dir][i] + 1 + || s->pict_type == AV_PICTURE_TYPE_B || s->first_field) && ref_picture[0]){ ref2picture= ref_picture; }else{ ref2picture = s->current_picture_ptr->f.data; @@ -854,6 +854,9 @@ static av_always_inline void MPV_motion_internal(MpegEncContext *s, pix_op = s->hdsp.avg_pixels_tab; } }else{ + if (!ref_picture[0]) { + ref_picture = s->current_picture_ptr->f.data; + } for(i=0; i<2; i++){ mpeg_motion(s, dest_y, dest_cb, dest_cr, s->picture_structure != i+1, |