mpeg12dec: reset data size after parsing extradata.
This ended up corrupting data structures and may possibly lead to a double free. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
41abc9da50
commit
951cbea56f
@ -2289,6 +2289,7 @@ static int mpeg_decode_frame(AVCodecContext *avctx,
|
||||
|
||||
if (avctx->extradata && !avctx->frame_number) {
|
||||
int ret = decode_chunks(avctx, picture, data_size, avctx->extradata, avctx->extradata_size);
|
||||
*data_size = 0;
|
||||
if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE))
|
||||
return ret;
|
||||
}
|
||||
|
Loading…
x
Reference in New Issue
Block a user