flashv: check if keyframe is available, fix null deref.
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 12 Nov 2012 23:21:59 +0000 (00:21 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 12 Nov 2012 23:22:24 +0000 (00:22 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/flashsv.c

index 643dab3..14c514c 100644 (file)
@@ -406,6 +406,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
                 int k;
                 int off = (s->image_height - y_pos - 1) * s->frame.linesize[0];
 
+                if (!s->keyframe) {
+                    av_log(avctx, AV_LOG_ERROR, "no keyframe yet\n");
+                    return AVERROR_INVALIDDATA;
+                }
                 for (k = 0; k < cur_blk_height; k++)
                     memcpy(s->frame.data[0] + off - k*s->frame.linesize[0] + x_pos*3,
                            s->keyframe + off - k*s->frame.linesize[0] + x_pos*3,