From 4162fc62b30d5b57910c17e46f2a9319a09cdae0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Nov 2012 00:48:15 +0100 Subject: vc1dec: Do not allow field_mode to change after the first header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes out of array accesses. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Martin Storsjö --- libavcodec/vc1dec.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'libavcodec/vc1dec.c') diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 86806b1d21..7345d5322b 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5463,6 +5463,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, // do parse frame header v->pic_header_flag = 0; + v->first_pic_header_flag = 1; if (v->profile < PROFILE_ADVANCED) { if (ff_vc1_parse_frame_header(v, &s->gb) < 0) { goto err; @@ -5472,6 +5473,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, goto err; } } + v->first_pic_header_flag = 0; if ((avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) && s->pict_type != AV_PICTURE_TYPE_I) { -- cgit v1.2.3