indeo3: Fix null ptr dereference

[ffmpeg] / libavcodec / 4xm.c

diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c
index e6638c7b4b3b51a2bd03b3f24a266f589ca57054..43f6a21ea8f0cabb8fbee506dc9590488d17c240 100644 (file)
--- a/libavcodec/4xm.c
+++ b/libavcodec/4xm.c
@@ -440,15 +440,6 @@ static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length){
         dst += 8*stride;
     }
 
-    if(   bitstream_size != (get_bits_count(&f->gb)+31)/32*4
-       || (((const char*)f->wordstream - (const char*)buf + 2)&~2) != extra + bitstream_size + wordstream_size
-       || (((const char*)f->bytestream - (const char*)buf + 3)&~3) != extra + bitstream_size + wordstream_size + bytestream_size)
-        av_log(f->avctx, AV_LOG_ERROR, " %d %td %td bytes left\n",
-            bitstream_size - (get_bits_count(&f->gb)+31)/32*4,
-            -(((const char*)f->bytestream - (const char*)buf + 3)&~3) + (extra + bitstream_size + wordstream_size + bytestream_size),
-            -(((const char*)f->wordstream - (const char*)buf + 2)&~2) + (extra + bitstream_size + wordstream_size)
-        );
-
     return 0;
 }
 
@@ -459,6 +450,11 @@ static int decode_p_frame(FourXContext *f, const uint8_t *buf, int length){
 static int decode_i_block(FourXContext *f, DCTELEM *block){
     int code, i, j, level, val;
 
+    if(get_bits_left(&f->gb) < 2){
+        av_log(f->avctx, AV_LOG_ERROR, "%d bits left before decode_i_block()\n", get_bits_left(&f->gb));
+        return -1;
+    }
+
     /* DC coef */
     val = get_vlc2(&f->pre_gb, f->pre_vlc.table, ACDC_VLC_BITS, 3);
     if (val>>4){
@@ -821,7 +817,7 @@ static int decode_frame(AVCodecContext *avctx,
 
     avctx->flags |= CODEC_FLAG_EMU_EDGE; // alternatively we would have to use our own buffer management
 
-    p->reference= 1;
+    p->reference= 3;
     if (avctx->reget_buffer(avctx, p) < 0) {
         av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
         return -1;
@@ -841,7 +837,7 @@ static int decode_frame(AVCodecContext *avctx,
         }
     }else if(frame_4cc == AV_RL32("pfrm") || frame_4cc == AV_RL32("pfr2")){
         if(!f->last_picture.data[0]){
-            f->last_picture.reference= 1;
+            f->last_picture.reference= 3;
             if(avctx->get_buffer(avctx, &f->last_picture) < 0){
                 av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
                 return -1;