From b2e57eb5a3cb9d5dfab601077fa0edee91e06ca5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 13 Feb 2013 14:20:01 +0100 Subject: [PATCH] mjpegdec: pass nb_components into ljpeg_decode_yuv_scan Fixes null pointer dereference Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/mjpegdec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index d472436778..ff37f11d4c 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -844,11 +844,10 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p return 0; } -static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, +static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int nb_components, int predictor, int point_transform) { int i, mb_x, mb_y; - const int nb_components=s->nb_components; int bits= (s->bits+7)&~7; int resync_mb_y = 0; int resync_mb_x = 0; @@ -1289,7 +1288,7 @@ next_field: if ((ret = ljpeg_decode_rgb_scan(s, nb_components, predictor, point_transform)) < 0) return ret; } else { - if ((ret = ljpeg_decode_yuv_scan(s, predictor, point_transform)) < 0) + if ((ret = ljpeg_decode_yuv_scan(s, nb_components, predictor, point_transform)) < 0) return ret; } }