avcodec/truemotion1: Initialize mb_change_byte only when needed
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 5 Nov 2015 02:15:24 +0000 (03:15 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 5 Nov 2015 02:16:15 +0000 (03:16 +0100)
Fixes out of array read
Fixes: d92114d8c2a019b8a6e50cd2a7301b54/asan_heap-oob_26bf563_60_1d3420277533de9dbf8aba3f93af346f.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/truemotion1.c

index b8d0de4..da843c4 100644 (file)
@@ -645,7 +645,8 @@ static void truemotion1_decode_16bit(TrueMotion1Context *s)
         current_pixel_pair = (unsigned int *)current_line;
         vert_pred = s->vert_pred;
         mb_change_index = 0;
-        mb_change_byte = mb_change_bits[mb_change_index++];
+        if (!keyframe)
+            mb_change_byte = mb_change_bits[mb_change_index++];
         mb_change_byte_mask = 0x01;
         pixels_left = s->avctx->width;