libopusdec: fix out-of-bounds read

[ffmpeg] / libavcodec / wmv2dec.c

diff --git a/libavcodec/wmv2dec.c b/libavcodec/wmv2dec.c
index c71fd3dfeae0742d165ae6c38a43d87ee38abaa7..e1f86d854b63734b0c17b9ac57f9abce37491885 100644 (file)
--- a/libavcodec/wmv2dec.c
+++ b/libavcodec/wmv2dec.c
@@ -228,7 +228,14 @@ int ff_wmv2_decode_secondary_picture_header(MpegEncContext *s)
     s->picture_number++; // FIXME ?
 
     if (w->j_type) {
-        ff_intrax8_decode_picture(&w->x8, 2 * s->qscale, (s->qscale - 1) | 1);
+        ff_intrax8_decode_picture(&w->x8, &s->current_picture,
+                                  &s->gb, &s->mb_x, &s->mb_y,
+                                  2 * s->qscale, (s->qscale - 1) | 1,
+                                  s->loop_filter, s->low_delay);
+
+        ff_er_add_slice(&w->s.er, 0, 0,
+                        (w->s.mb_x >> 1) - 1, (w->s.mb_y >> 1) - 1,
+                        ER_MB_END);
         return 1;
     }
 
@@ -467,9 +474,9 @@ static av_cold int wmv2_decode_init(AVCodecContext *avctx)
 
     ff_wmv2_common_init(w);
 
-    ff_intrax8_common_init(&w->x8, &w->s);
-
-    return 0;
+    return ff_intrax8_common_init(avctx, &w->x8, &w->s.idsp,
+                                  w->s.block, w->s.block_last_index,
+                                  w->s.mb_width, w->s.mb_height);
 }
 
 static av_cold int wmv2_decode_end(AVCodecContext *avctx)