indeo5: Fix null pointer dereferences of ref_mb

[ffmpeg] / libavcodec / fraps.c

diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c
index aad8731028116b3f339cc6a3b06845fd9b01266b..de98da72ea740643a52bc866b9de2bcc8d68d609 100644 (file)
--- a/libavcodec/fraps.c
+++ b/libavcodec/fraps.c
@@ -112,6 +112,10 @@ static int fraps2_decode_plane(FrapsContext *s, uint8_t *dst, int stride, int w,
              */
             if(j) dst[i] += dst[i - stride];
             else if(Uoff) dst[i] += 0x80;
+            if (get_bits_left(&gb) < 0) {
+                free_vlc(&vlc);
+                return AVERROR_INVALIDDATA;
+            }
         }
         dst += stride;
     }
@@ -172,7 +176,7 @@ static int decode_frame(AVCodecContext *avctx,
             return -1;
         }
 
-        f->reference = 1;
+        f->reference = 3;
         f->buffer_hints = FF_BUFFER_HINTS_VALID |
                           FF_BUFFER_HINTS_PRESERVE |
                           FF_BUFFER_HINTS_REUSABLE;
@@ -215,7 +219,7 @@ static int decode_frame(AVCodecContext *avctx,
             return -1;
         }
 
-        f->reference = 1;
+        f->reference = 3;
         f->buffer_hints = FF_BUFFER_HINTS_VALID |
                           FF_BUFFER_HINTS_PRESERVE |
                           FF_BUFFER_HINTS_REUSABLE;
@@ -243,7 +247,7 @@ static int decode_frame(AVCodecContext *avctx,
          */
         avctx->pix_fmt = PIX_FMT_YUVJ420P;
         planes = 3;
-        f->reference = 1;
+        f->reference = 3;
         f->buffer_hints = FF_BUFFER_HINTS_VALID |
                           FF_BUFFER_HINTS_PRESERVE |
                           FF_BUFFER_HINTS_REUSABLE;
@@ -288,7 +292,7 @@ static int decode_frame(AVCodecContext *avctx,
         /* Virtually the same as version 4, but is for RGB24 */
         avctx->pix_fmt = PIX_FMT_BGR24;
         planes = 3;
-        f->reference = 1;
+        f->reference = 3;
         f->buffer_hints = FF_BUFFER_HINTS_VALID |
                           FF_BUFFER_HINTS_PRESERVE |
                           FF_BUFFER_HINTS_REUSABLE;