Commit 951cbea5 authored by Michael Niedermayer's avatar Michael Niedermayer

mpeg12dec: reset data size after parsing extradata.

This ended up corrupting data structures and may possibly
lead to a double free.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 41abc9da
......@@ -2289,6 +2289,7 @@ static int mpeg_decode_frame(AVCodecContext *avctx,
if (avctx->extradata && !avctx->frame_number) {
int ret = decode_chunks(avctx, picture, data_size, avctx->extradata, avctx->extradata_size);
*data_size = 0;
if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
return ret;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment