This is a more appropriate place than a function designed to reconstruct a macroblock. It furthermore limits these checks to the codecs that actually need it (and removes it from e.g. RV10 and RV20 -- the latter actually uses these buffers, but only for intra-frames, so they don't need to be cleaned manually). This furthermore means that ff_mpv_reconstruct_mb() and therefore also the error-resilience code no longer needs block_index set. This fixes a crash caused by 65d5ccb808ec93de46a2458ea8cc082ce4460f34 when ff_mpv_reconstruct_mb() is called by VC-1 code without block_index being initialized properly (VC-1 uses and initializes block_index itself normally). Fixes: 69814/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_VC1_fuzzer-4868081575329792 Fixes: heap-buffer-overflow
Showing the changes to libavcodec (2 of 2 files). Show all
Unified · Split
| @@ -271,6 +271,15 @@ static int decode_slice(MpegEncContext *s) · 270 unmodified lines | |||
| 271 | ff_tlog(NULL, "Decoding MB at %dx%d\n", s->mb_x, s->mb_y); | 271 | ff_tlog(NULL, "Decoding MB at %dx%d\n", s->mb_x, s->mb_y); |
| 272 | ret = s->decode_mb(s, s->block); | 272 | ret = s->decode_mb(s, s->block); |
| 273 | 273 | ||
| 274 | if (s->h263_pred || s->h263_aic) { | ||
| 275 | int mb_xy = s->mb_y * s->mb_stride + s->mb_x; | ||
| 276 | if (!s->mb_intra) { | ||
| 277 | if (s->mbintra_table[mb_xy]) | ||
| 278 | ff_clean_intra_table_entries(s); | ||
| 279 | } else | ||
| 280 | s->mbintra_table[mb_xy] = 1; | ||
| 281 | } | ||
| 282 | |||
| 274 | if (s->pict_type != AV_PICTURE_TYPE_B) | 283 | if (s->pict_type != AV_PICTURE_TYPE_B) |
| 275 | ff_h263_update_motion_val(s); | 284 | ff_h263_update_motion_val(s); |
| 276 | 285 | ||
| @@ -61,6 +61,7 @@ void mpv_reconstruct_mb_internal(MpegEncContext *s, int16_t block[12][64], · 60 unmodified lines | |||
| 61 | 61 | ||
| 62 | s->cur_pic.qscale_table[mb_xy] = s->qscale; | 62 | s->cur_pic.qscale_table[mb_xy] = s->qscale; |
| 63 | 63 | ||
| 64 | #if IS_ENCODER | ||
| 64 | /* update DC predictors for P macroblocks */ | 65 | /* update DC predictors for P macroblocks */ |
| 65 | if (!s->mb_intra) { | 66 | if (!s->mb_intra) { |
| 66 | if (is_mpeg12 != DEFINITELY_MPEG12_H261 && (s->h263_pred || s->h263_aic)) { | 67 | if (is_mpeg12 != DEFINITELY_MPEG12_H261 && (s->h263_pred || s->h263_aic)) { |
| @@ -70,7 +71,6 @@ void mpv_reconstruct_mb_internal(MpegEncContext *s, int16_t block[12][64], · 3 unmodified lines | |||
| 70 | } else if (is_mpeg12 != DEFINITELY_MPEG12_H261 && (s->h263_pred || s->h263_aic)) | 71 | } else if (is_mpeg12 != DEFINITELY_MPEG12_H261 && (s->h263_pred || s->h263_aic)) |
| 71 | s->mbintra_table[mb_xy] = 1; | 72 | s->mbintra_table[mb_xy] = 1; |
| 72 | 73 | ||
| 73 | #if IS_ENCODER | ||
| 74 | if ((s->avctx->flags & AV_CODEC_FLAG_PSNR) || s->frame_skip_threshold || s->frame_skip_factor || | 74 | if ((s->avctx->flags & AV_CODEC_FLAG_PSNR) || s->frame_skip_threshold || s->frame_skip_factor || |
| 75 | !((s->intra_only || s->pict_type == AV_PICTURE_TYPE_B) && | 75 | !((s->intra_only || s->pict_type == AV_PICTURE_TYPE_B) && |
| 76 | s->avctx->mb_decision != FF_MB_DECISION_RD)) // FIXME precalc | 76 | s->avctx->mb_decision != FF_MB_DECISION_RD)) // FIXME precalc |