RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Check the return value of ff_rv34_decode_init() in rv30.c and rv40.c 

Avoids possible null pointer dereferences on oom.

Fixes ticket #2727.
This commit is contained in:
Carl Eugen Hoyos 2013-07-08 00:34:58 +02:00
parent 5d3c3035b7
commit b86651a208
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/rv30.c
View File

@ -248,9 +248,12 @@ static void rv30_loop_filter(RV34DecContext *r, int row)
static av_cold int rv30_decode_init(AVCodecContext *avctx)
{
RV34DecContext *r = avctx->priv_data;
int ret;
r->rv30 = 1;
ff_rv34_decode_init(avctx);
ret = ff_rv34_decode_init(avctx);
if (ret < 0)
return ret;
if(avctx->extradata_size < 2){
av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
return -1;

5
libavcodec/rv40.c
View File

@ -547,9 +547,12 @@ static void rv40_loop_filter(RV34DecContext *r, int row)
static av_cold int rv40_decode_init(AVCodecContext *avctx)
{
RV34DecContext *r = avctx->priv_data;
int ret;
r->rv30 = 0;
ff_rv34_decode_init(avctx);
ret = ff_rv34_decode_init(avctx);
if (ret < 0)
return ret;
if(!aic_top_vlc.bits)
rv40_init_tables();
r->parse_slice_header = rv40_parse_slice_header;