1. ffmpeg
  2. Commit f246d46ee66678bdd23e939aaede28943cfeb8da
Browse code

indeo5: Fix null pointer dereferences of ref_mb

Reviewed-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f41a6c8f3aeb51332bb359038cb504d3fb562a52)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2011/12/29 10:34:43
Showing 1 changed files
libavcodec/indeo5.c
History View file @ f246d46
... ... 
@@ -482,7 +482,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
482 482 
                 }
483 483
484 484 
                 mb->mv_x = mb->mv_y = 0; /* no motion vector coded */
485 
-                if (band->inherit_mv){
485 
+                if (band->inherit_mv && ref_mb){
486 486 
                     /* motion vector inheritance */
487 487 
                     if (mv_scale) {
488 488 
                         mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);
... ... 
@@ -493,7 +493,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
493 493 
                     }
494 494 
                 }
495 495 
             } else {
496 
-                if (band->inherit_mv) {
496 
+                if (band->inherit_mv && ref_mb) {
497 497 
                     mb->type = ref_mb->type; /* copy mb_type from corresponding reference mb */
498 498 
                 } else if (ctx->frame_type == FRAMETYPE_INTRA) {
499 499 
                     mb->type = 0; /* mb_type is always INTRA for intra-frames */
... ... 
@@ -519,7 +519,7 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
519 519 
                 if (!mb->type) {
520 520 
                     mb->mv_x = mb->mv_y = 0; /* there is no motion vector in intra-macroblocks */
521 521 
                 } else {
522 
-                    if (band->inherit_mv){
522 
+                    if (band->inherit_mv && ref_mb){
523 523 
                         /* motion vector inheritance */
524 524 
                         if (mv_scale) {
525 525 
                             mb->mv_x = ivi_scale_mv(ref_mb->mv_x, mv_scale);