提交 69a0bce7 编写于 作者: L Laurent Aimar 提交者: Janne Grunau

Fixed deference of NULL pointer in motionpixels decoder.

Some of the arguments given to init_vlc() come from the stream
and can be corrupted.
Signed-off-by: NJanne Grunau <janne-libav@jannau.net>
上级 d97efd7f
......@@ -278,7 +278,8 @@ static int mp_decode_frame(AVCodecContext *avctx,
if (sz == 0)
goto end;
init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0);
if (init_vlc(&mp->vlc, mp->max_codes_bits, mp->codes_count, &mp->codes[0].size, sizeof(HuffCode), 1, &mp->codes[0].code, sizeof(HuffCode), 4, 0))
goto end;
mp_decode_frame_helper(mp, &gb);
free_vlc(&mp->vlc);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册