diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-05 03:15:24 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-05 03:16:15 +0100 |
| commit | a813cdda487e252681df36f675332b04c2e0e5a6 (patch) | |
| tree | 4885ac184972361470ed99885abfd7a7e978dac8 | |
| parent | a8b254e436dce2f5c8c6459108dab4b02cc6b79b (diff) | |
| download | ffmpeg-streaming-a813cdda487e252681df36f675332b04c2e0e5a6.zip ffmpeg-streaming-a813cdda487e252681df36f675332b04c2e0e5a6.tar.gz | |
avcodec/truemotion1: Initialize mb_change_byte only when needed
Fixes out of array read
Fixes: d92114d8c2a019b8a6e50cd2a7301b54/asan_heap-oob_26bf563_60_1d3420277533de9dbf8aba3f93af346f.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/truemotion1.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c index b8d0de4..da843c4 100644 --- a/libavcodec/truemotion1.c +++ b/libavcodec/truemotion1.c @@ -645,7 +645,8 @@ static void truemotion1_decode_16bit(TrueMotion1Context *s) current_pixel_pair = (unsigned int *)current_line; vert_pred = s->vert_pred; mb_change_index = 0; - mb_change_byte = mb_change_bits[mb_change_index++]; + if (!keyframe) + mb_change_byte = mb_change_bits[mb_change_index++]; mb_change_byte_mask = 0x01; pixels_left = s->avctx->width; |
