har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

h264: always copy block_offset in thread update

Browse Source 
Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-17 00:00:34 +01:00
parent 641bbd9671
commit f674cc776f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/h264.c
View File

@ -1221,12 +1221,12 @@ static int decode_update_thread_context(AVCodecContext *dst,
s->linesize = s1->linesize;
s->uvlinesize = s1->uvlinesize;
/* copy block_offset since frame_start may not be called */
memcpy(h->block_offset, h1->block_offset, sizeof(h->block_offset));
h264_set_parameter_from_sps(h);
//Note we set context_reinitialized which will cause h264_set_parameter_from_sps to be reexecuted
h->cur_chroma_format_idc = h1->cur_chroma_format_idc;
}
/* copy block_offset since frame_start may not be called */
memcpy(h->block_offset, h1->block_offset, sizeof(h->block_offset));
err = ff_mpeg_update_thread_context(dst, src);
if (err)