mpeg12dec: reset data size after parsing extradata.
This ended up corrupting data structures and may possibly lead to a double free. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
		
							parent
							
								
									41abc9da50
								
							
						
					
					
						commit
						951cbea56f
					
				@ -2289,6 +2289,7 @@ static int mpeg_decode_frame(AVCodecContext *avctx,
 | 
			
		||||
 | 
			
		||||
    if (avctx->extradata && !avctx->frame_number) {
 | 
			
		||||
        int ret = decode_chunks(avctx, picture, data_size, avctx->extradata, avctx->extradata_size);
 | 
			
		||||
        *data_size = 0;
 | 
			
		||||
        if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
 | 
			
		||||
            return ret;
 | 
			
		||||
    }
 | 
			
		||||
 | 
			
		||||
		Loading…
	
	
			
			x
			
			
		
	
		Reference in New Issue
	
	Block a user