Commit 69a0bce7 authored by Laurent Aimar's avatar Laurent Aimar Committed by Janne Grunau

Fixed deference of NULL pointer in motionpixels decoder.

Some of the arguments given to init_vlc() come from the stream
and can be corrupted.
Signed-off-by: 's avatarJanne Grunau <janne-libav@jannau.net>
parent d97efd7f
......@@ -278,7 +278,8 @@ static int mp_decode_frame(AVCodecContext *avctx,
if (sz == 0)
goto end;
init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0);
if (init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0))
goto end;
mp_decode_frame_helper(mp, &gb);
free_vlc(&mp->vlc);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment