These values are not read anywhere. Furthermore, since commit fe6037fd04db8837dcdb9013f9c4ad4e7eb0592e the linesize values of the MPVWorkPictures were wrong for subsequent fields in a chain of B-pictures (as they are always doubled and no longer based upon the frame-linesizes) which can eventually lead to overflow. Finally, it makes no real sense to ever double the linesize of the reference pictures at all: Even when the current picture is a field, it can still reference both fields of reference pictures and therefore the linesize should allow to address both fields (for the same reason, data is not offset for reference pictures). libavcodec/mpeg12dec.c:1304:41: runtime error: signed integer overflow: 4611686018427387904 * 2 cannot be represented in type 'long' issue: 69732/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_MPEGVIDEO_fuzzer-5123551179374592
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -1278,8 +1278,6 @@ static int mpeg_field_start(Mpeg1Context *s1, const uint8_t *buf, int buf_size) · 1277 unmodified lines | |||
| 1278 | s->cur_pic.linesize[i]); | 1278 | s->cur_pic.linesize[i]); |
| 1279 | } | 1279 | } |
| 1280 | s->cur_pic.linesize[i] *= 2; | 1280 | s->cur_pic.linesize[i] *= 2; |
| 1281 | s->last_pic.linesize[i] *= 2; | ||
| 1282 | s->next_pic.linesize[i] *= 2; | ||
| 1283 | } | 1281 | } |
| 1284 | } | 1282 | } |
| 1285 | 1283 | ||