diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-16 00:48:15 +0100 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2013-05-15 12:13:53 +0300 |
| commit | 4162fc62b30d5b57910c17e46f2a9319a09cdae0 (patch) | |
| tree | e0b1e986b98ed70474759a188d3633a0bac50c79 /libavcodec/vc1dec.c | |
| parent | ec7d002e55590bf9e2c2745065ec3463364a5273 (diff) | |
vc1dec: Do not allow field_mode to change after the first header
This fixes out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavcodec/vc1dec.c')
| -rw-r--r-- | libavcodec/vc1dec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 86806b1d21..7345d5322b 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5463,6 +5463,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, // do parse frame header v->pic_header_flag = 0; + v->first_pic_header_flag = 1; if (v->profile < PROFILE_ADVANCED) { if (ff_vc1_parse_frame_header(v, &s->gb) < 0) { goto err; @@ -5472,6 +5473,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, goto err; } } + v->first_pic_header_flag = 0; if ((avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) && s->pict_type != AV_PICTURE_TYPE_I) { |