From 95bd18eeca4c6f1599d0ca09b37d0e66c82bed8e Mon Sep 17 00:00:00 2001 From: Kostya Shishkov Date: Tue, 9 Mar 2010 07:14:34 +0000 Subject: [PATCH] Check for reference frames so RV 3/4 won't segfault trying to copy data from nonexisting reference. Originally committed as revision 22378 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/rv34.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index 50ded79977..1100fbd244 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1452,8 +1452,12 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "First slice header is incorrect\n"); return -1; } + if((!s->last_picture_ptr || !s->last_picture_ptr->data[0]) && si.type == FF_P_TYPE) + return -1; if((!s->last_picture_ptr || !s->last_picture_ptr->data[0]) && si.type == FF_B_TYPE) return -1; + if((!s->next_picture_ptr || !s->next_picture_ptr->data[0]) && si.type == FF_B_TYPE) + return -1; /* skip b frames if we are in a hurry */ if(avctx->hurry_up && si.type==FF_B_TYPE) return buf_size; if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==FF_B_TYPE)