Fixed deference of NULL pointer in motionpixels decoder.
authorLaurent Aimar <fenrir@videolan.org>
Sat, 10 Sep 2011 11:28:13 +0000 (13:28 +0200)
committerJanne Grunau <janne-libav@jannau.net>
Thu, 6 Oct 2011 20:29:12 +0000 (22:29 +0200)
Some of the arguments given to init_vlc() come from the stream
and can be corrupted.

Signed-off-by: Janne Grunau <janne-libav@jannau.net>
libavcodec/motionpixels.c

index 21e1bda..9589b4c 100644 (file)
@@ -278,7 +278,8 @@ static int mp_decode_frame(AVCodecContext *avctx,
     if (sz == 0)
         goto end;
 
-    init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0);
+    if (init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0))
+        goto end;
     mp_decode_frame_helper(mp, &gb);
     free_vlc(&mp->vlc);