Commit 075a165d authored by Michael Niedermayer's avatar Michael Niedermayer

avcodec/svq3: Dont memcpy AVFrame

This avoids out of array accesses

Fixes: asan_heap-uaf_21f42e4_9_asan_heap-uaf_21f42e4_278_gl2.mov

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent c727401a
...@@ -1176,7 +1176,7 @@ static int svq3_decode_frame(AVCodecContext *avctx, void *data, ...@@ -1176,7 +1176,7 @@ static int svq3_decode_frame(AVCodecContext *avctx, void *data,
h->cur_pic_ptr = s->cur_pic; h->cur_pic_ptr = s->cur_pic;
av_frame_unref(&h->cur_pic.f); av_frame_unref(&h->cur_pic.f);
h->cur_pic = *s->cur_pic; memcpy(&h->cur_pic.tf, &s->cur_pic->tf, sizeof(h->cur_pic) - offsetof(H264Picture, tf));
ret = av_frame_ref(&h->cur_pic.f, &s->cur_pic->f); ret = av_frame_ref(&h->cur_pic.f, &s->cur_pic->f);
if (ret < 0) if (ret < 0)
return ret; return ret;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment