From: "Ronald S. Bultje" <[email protected]> Prevents crash when trying to copy from a non-existing plane in e.g. a RGB32 reference image to a YUV420P target image
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] --- libavcodec/fraps.c | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c index 3643325..1c1a451 100644 --- a/libavcodec/fraps.c +++ b/libavcodec/fraps.c @@ -160,6 +160,10 @@ static int decode_frame(AVCodecContext *avctx, case 0: default: /* Fraps v0 is a reordered YUV420 */ + if (avctx->pix_fmt != PIX_FMT_NONE && + avctx->pix_fmt != PIX_FMT_YUVJ420P && + f->data[0]) + avctx->release_buffer(avctx, f); avctx->pix_fmt = PIX_FMT_YUVJ420P; if ( (buf_size != avctx->width*avctx->height*3/2+header_size) && @@ -209,6 +213,10 @@ static int decode_frame(AVCodecContext *avctx, case 1: /* Fraps v1 is an upside-down BGR24 */ + if (avctx->pix_fmt != PIX_FMT_NONE && + avctx->pix_fmt != PIX_FMT_BGR24 && + f->data[0]) + avctx->release_buffer(avctx, f); avctx->pix_fmt = PIX_FMT_BGR24; if ( (buf_size != avctx->width*avctx->height*3+header_size) && @@ -245,6 +253,10 @@ static int decode_frame(AVCodecContext *avctx, * Fraps v2 is Huffman-coded YUV420 planes * Fraps v4 is virtually the same */ + if (avctx->pix_fmt != PIX_FMT_NONE && + avctx->pix_fmt != PIX_FMT_YUVJ420P && + f->data[0]) + avctx->release_buffer(avctx, f); avctx->pix_fmt = PIX_FMT_YUVJ420P; planes = 3; f->reference = 1; @@ -291,6 +303,10 @@ static int decode_frame(AVCodecContext *avctx, case 3: case 5: /* Virtually the same as version 4, but is for RGB24 */ + if (avctx->pix_fmt != PIX_FMT_NONE && + avctx->pix_fmt != PIX_FMT_BGR24 && + f->data[0]) + avctx->release_buffer(avctx, f); avctx->pix_fmt = PIX_FMT_BGR24; planes = 3; f->reference = 1; -- 1.7.7.4 _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
