• Ronald S. Bultje's avatar
    rv34: set mb_num_left to 0 after finishing a frame · 5484170a
    Ronald S. Bultje authored
    Prevents running error resilience on a previous frame which will write
    to the pic->mb_type[] array of the previous image. The array might
    already be re-used for a new image in a subsequent thread, thus cause
    two threads to write to the same pic->mb_type[] array, causing a race
    condition which can crash in rv34_decode_cbp(), called by
    rv34_decode_inter_mb_header() (which accesses mb_type[] twice,
    assuming values are maintained, which the race condition breaks).
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    CC: libav-stable@libav.org
    5484170a
rv34.c 61.9 KB