Commit a6667526 authored by Michael Niedermayer's avatar Michael Niedermayer

indeo5: dont run the wavelet transform over partially decoded bands.

This fixes a null pointer dereference.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent e90dfa68
...@@ -78,6 +78,7 @@ typedef struct { ...@@ -78,6 +78,7 @@ typedef struct {
IVIPicConfig pic_conf; IVIPicConfig pic_conf;
int gop_invalid; int gop_invalid;
int buf_invalid[3];
} IVI5DecContext; } IVI5DecContext;
...@@ -797,6 +798,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, ...@@ -797,6 +798,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
//{ START_TIMER; //{ START_TIMER;
if (ctx->frame_type != FRAMETYPE_NULL) { if (ctx->frame_type != FRAMETYPE_NULL) {
ctx->buf_invalid[ctx->dst_buf] = 1;
for (p = 0; p < 3; p++) { for (p = 0; p < 3; p++) {
for (b = 0; b < ctx->planes[p].num_bands; b++) { for (b = 0; b < ctx->planes[p].num_bands; b++) {
result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx); result = decode_band(ctx, p, &ctx->planes[p].bands[b], avctx);
...@@ -807,7 +809,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, ...@@ -807,7 +809,10 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
} }
} }
} }
ctx->buf_invalid[ctx->dst_buf] = 0;
} }
if (ctx->buf_invalid[ctx->dst_buf])
return -1;
//STOP_TIMER("decode_planes"); } //STOP_TIMER("decode_planes"); }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment