Browse code

Check the return value of ff_rv34_decode_init() in rv30.c and rv40.c

Avoids possible null pointer dereferences on oom.

Fixes ticket #2727.

Carl Eugen Hoyos authored on 2013/07/08 07:34:58
Showing 2 changed files
... ...
@@ -248,9 +248,12 @@ static void rv30_loop_filter(RV34DecContext *r, int row)
248 248
 static av_cold int rv30_decode_init(AVCodecContext *avctx)
249 249
 {
250 250
     RV34DecContext *r = avctx->priv_data;
251
+    int ret;
251 252
 
252 253
     r->rv30 = 1;
253
-    ff_rv34_decode_init(avctx);
254
+    ret = ff_rv34_decode_init(avctx);
255
+    if (ret < 0)
256
+        return ret;
254 257
     if(avctx->extradata_size < 2){
255 258
         av_log(avctx, AV_LOG_ERROR, "Extradata is too small.\n");
256 259
         return -1;
... ...
@@ -547,9 +547,12 @@ static void rv40_loop_filter(RV34DecContext *r, int row)
547 547
 static av_cold int rv40_decode_init(AVCodecContext *avctx)
548 548
 {
549 549
     RV34DecContext *r = avctx->priv_data;
550
+    int ret;
550 551
 
551 552
     r->rv30 = 0;
552
-    ff_rv34_decode_init(avctx);
553
+    ret = ff_rv34_decode_init(avctx);
554
+    if (ret < 0)
555
+        return ret;
553 556
     if(!aic_top_vlc.bits)
554 557
         rv40_init_tables();
555 558
     r->parse_slice_header = rv40_parse_slice_header;