• Ronald S. Bultje's avatar
    rv34: set mb_num_left to 0 after finishing a frame · 5484170a
    Ronald S. Bultje authored
    Prevents running error resilience on a previous frame which will write
    to the pic->mb_type[] array of the previous image. The array might
    already be re-used for a new image in a subsequent thread, thus cause
    two threads to write to the same pic->mb_type[] array, causing a race
    condition which can crash in rv34_decode_cbp(), called by
    rv34_decode_inter_mb_header() (which accesses mb_type[] twice,
    assuming values are maintained, which the race condition breaks).
    
    Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
    CC: libav-stable@libav.org
    5484170a
Name
Last commit
Last update
doc Loading commit data...
libavcodec Loading commit data...
libavdevice Loading commit data...
libavfilter Loading commit data...
libavformat Loading commit data...
libavutil Loading commit data...
libswscale Loading commit data...
presets Loading commit data...
tests Loading commit data...
tools Loading commit data...
.gitignore Loading commit data...
COPYING.GPLv2 Loading commit data...
COPYING.GPLv3 Loading commit data...
COPYING.LGPLv2.1 Loading commit data...
COPYING.LGPLv3 Loading commit data...
CREDITS Loading commit data...
Changelog Loading commit data...
Doxyfile Loading commit data...
INSTALL Loading commit data...
LICENSE Loading commit data...
Makefile Loading commit data...
README Loading commit data...
RELEASE Loading commit data...
avconv.c Loading commit data...
avplay.c Loading commit data...
avprobe.c Loading commit data...
avserver.c Loading commit data...
cmdutils.c Loading commit data...
cmdutils.h Loading commit data...
cmdutils_common_opts.h Loading commit data...
common.mak Loading commit data...
configure Loading commit data...
library.mak Loading commit data...
version.sh Loading commit data...