From: Aaron Colwell <[email protected]>

The next call to decode() will update from an invalid index, which will
either lead to a memcpy() where dest==src (2 threads), or lead to a
crash (>2 threads).

Signed-off-by: Ronald S. Bultje <[email protected]>
---
 libavcodec/pthread.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/libavcodec/pthread.c b/libavcodec/pthread.c
index 21e32b5..1364f57 100644
--- a/libavcodec/pthread.c
+++ b/libavcodec/pthread.c
@@ -491,6 +491,7 @@ static int submit_packet(PerThreadContext *p, AVPacket 
*avpkt)
     }
 
     fctx->prev_thread = p;
+    fctx->next_decoding++;
 
     return 0;
 }
@@ -513,8 +514,6 @@ int ff_thread_decode_frame(AVCodecContext *avctx,
     err = submit_packet(p, avpkt);
     if (err) return err;
 
-    fctx->next_decoding++;
-
     /*
      * If we're still receiving the initial packets, don't return a frame.
      */
-- 
1.7.2.1

_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to