Fixes out of array accesses.
Unified · Split
| @@ -834,6 +834,7 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) · 833 unmodified lines | ||
| 834 | 834 | int status; |
| 835 | 835 | int mbmodetab, imvtab, icbptab, twomvbptab, fourmvbptab; /* useful only for debugging */ |
| 836 | 836 | int scale, shift, i; /* for initializing LUT for intensity compensation */ |
| 837 | + int field_mode, fcm; | |
| 837 | 838 | |
| 838 | 839 | v->numref=0; |
| 839 | 840 | v->p_frame_skipped = 0; |
| @@ -848,19 +849,23 @@ int ff_vc1_parse_frame_header_adv(VC1Context *v, GetBitContext* gb) · 8 unmodified lines | ||
| 848 | 849 | goto parse_common_info; |
| 849 | 850 | } |
| 850 | 851 | |
| 851 | − v->field_mode = 0; | |
| 852 | + field_mode = 0; | |
| 852 | 853 | if (v->interlace) { |
| 853 | − v->fcm = decode012(gb); | |
| 854 | − if (v->fcm) { | |
| 855 | − if (v->fcm == ILACE_FIELD) | |
| 856 | − v->field_mode = 1; | |
| 854 | + fcm = decode012(gb); | |
| 855 | + if (fcm) { | |
| 856 | + if (fcm == ILACE_FIELD) | |
| 857 | + field_mode = 1; | |
| 857 | 858 | if (!v->warn_interlaced++) |
| 858 | 859 | av_log(v->s.avctx, AV_LOG_ERROR, |
| 859 | 860 | "Interlaced frames/fields support is incomplete\n"); |
| 860 | 861 | } |
| 861 | 862 | } else { |
| 862 | − v->fcm = PROGRESSIVE; | |
| 863 | + fcm = PROGRESSIVE; | |
| 863 | 864 | } |
| 865 | + if (!v->first_pic_header_flag && v->field_mode != field_mode) | |
| 866 | + return -1; | |
| 867 | + v->field_mode = field_mode; | |
| 868 | + v->fcm = fcm; | |
| 864 | 869 | |
| 865 | 870 | if (v->field_mode) { |
| 866 | 871 | v->fptype = get_bits(gb, 3); |
| @@ -368,6 +368,7 @@ typedef struct VC1Context{ · 367 unmodified lines | ||
| 368 | 368 | int qs_last; ///< if qpel has been used in the previous (tr.) picture |
| 369 | 369 | int bmvtype; |
| 370 | 370 | int frfd, brfd; ///< reference frame distance (forward or backward) |
| 371 | + int first_pic_header_flag; | |
| 371 | 372 | int pic_header_flag; |
| 372 | 373 | |
| 373 | 374 | /** Frame decoding info for sprite modes */ |
| @@ -5516,6 +5516,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, · 5515 unmodified lines | ||
| 5516 | 5516 | |
| 5517 | 5517 | // do parse frame header |
| 5518 | 5518 | v->pic_header_flag = 0; |
| 5519 | + v->first_pic_header_flag = 1; | |
| 5519 | 5520 | if (v->profile < PROFILE_ADVANCED) { |
| 5520 | 5521 | if (ff_vc1_parse_frame_header(v, &s->gb) < 0) { |
| 5521 | 5522 | goto err; |
| @@ -5525,6 +5526,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data, · 3 unmodified lines | ||
| 5525 | 5526 | goto err; |
| 5526 | 5527 | } |
| 5527 | 5528 | } |
| 5529 | + v->first_pic_header_flag = 0; | |
| 5528 | 5530 | |
| 5529 | 5531 | if (avctx->debug & FF_DEBUG_PICT_INFO) |
| 5530 | 5532 | av_log(v->s.avctx, AV_LOG_DEBUG, "pict_type: %c\n", av_get_picture_type_char(s->pict_type)); |