From f674cc776f201973c81c5c44d72f164d2bc029c1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 17 Jan 2013 00:00:34 +0100 Subject: [PATCH] h264: always copy block_offset in thread update Fixes out of array accesses Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/h264.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 4d935aed15..6cfb4ac67d 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -1221,12 +1221,12 @@ static int decode_update_thread_context(AVCodecContext *dst, s->linesize = s1->linesize; s->uvlinesize = s1->uvlinesize; - /* copy block_offset since frame_start may not be called */ - memcpy(h->block_offset, h1->block_offset, sizeof(h->block_offset)); h264_set_parameter_from_sps(h); //Note we set context_reinitialized which will cause h264_set_parameter_from_sps to be reexecuted h->cur_chroma_format_idc = h1->cur_chroma_format_idc; } + /* copy block_offset since frame_start may not be called */ + memcpy(h->block_offset, h1->block_offset, sizeof(h->block_offset)); err = ff_mpeg_update_thread_context(dst, src); if (err)