X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fvc1dec.c;h=5e00a33e3d92913b0dabd5fd51a07e02c0ccaeac;hb=f9e7a2f95a7194a8736cc1416a03a1a0155a3e9f;hp=f72b6c644f15cf09a6c815f2dbc8fcc737b19922;hpb=9fa888c02801fff2e8817c24068f5296bbe60000;p=ffmpeg

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index f72b6c644f1..5e00a33e3d9 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -270,7 +270,7 @@ static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb)
 
     vc1_parse_sprites(v, gb, &sd);
 
-    if (!s->current_picture.f->data[0]) {
+    if (!s->current_picture.f || !s->current_picture.f->data[0]) {
         av_log(avctx, AV_LOG_ERROR, "Got no sprites\n");
         return -1;
     }
@@ -381,8 +381,7 @@ av_cold int ff_vc1_decode_init_alloc_tables(VC1Context *v)
 
     ret = ff_intrax8_common_init(s->avctx, &v->x8, &s->idsp,
                                  s->block, s->block_last_index,
-                                 s->mb_width, s->mb_height,
-                                 s);
+                                 s->mb_width, s->mb_height);
     if (ret < 0)
         goto error;
 
@@ -410,7 +409,7 @@ av_cold void ff_vc1_init_transposed_scantables(VC1Context *v)
 
 /** Initialize a VC1/WMV3 decoder
  * @todo TODO: Handle VC-1 IDUs (Transport level?)
- * @todo TODO: Decypher remaining bits in extra_data
+ * @todo TODO: Decipher remaining bits in extra_data
  */
 static av_cold int vc1_decode_init(AVCodecContext *avctx)
 {
@@ -432,7 +431,7 @@ static av_cold int vc1_decode_init(AVCodecContext *avctx)
 
     if (ff_vc1_init_common(v) < 0)
         return -1;
-    ff_blockdsp_init(&s->bdsp, avctx);
+    ff_blockdsp_init(&s->bdsp);
     ff_h264chroma_init(&v->h264chroma, 8);
     ff_qpeldsp_init(&s->qdsp);
 
@@ -882,6 +881,12 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
                 s->end_mb_y = (i == n_slices     ) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);
             else
                 s->end_mb_y = (i <= n_slices1 + 1) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height);
+
+            if (s->end_mb_y <= s->start_mb_y) {
+                av_log(v->s.avctx, AV_LOG_ERROR, "Invalid slice size\n");
+                goto err;
+            }
+
             ff_vc1_decode_blocks(v);
             if (i != n_slices)
                 s->gb = slices[i].gb;
@@ -957,6 +962,7 @@ static const enum AVPixelFormat vc1_hwaccel_pixfmt_list_420[] = {
 #endif
 #if CONFIG_VC1_D3D11VA_HWACCEL
     AV_PIX_FMT_D3D11VA_VLD,
+    AV_PIX_FMT_D3D11,
 #endif
 #if CONFIG_VC1_VAAPI_HWACCEL
     AV_PIX_FMT_VAAPI,