diff mbox

[FFmpeg-devel] lavc/vda_h264_dec.c Fix NULL pointer dereference

Message ID 1486696814-16632-1-git-send-email-pkoshevoy@gmail.com
State Accepted
Commit e3f1b993341ec9ed542b07c4558baeea6921ed53
Headers show

Commit Message

Pavel Koshevoy Feb. 10, 2017, 3:20 a.m. UTC
From: Pavel Koshevoy <pkoshevoy@gmail.com>

ps.sps_list entries may be NULL, so check before dereferencing
---
 libavcodec/vda_h264_dec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Pavel Koshevoy Feb. 15, 2017, 5:05 p.m. UTC | #1
On Thu, Feb 9, 2017 at 8:20 PM,  <pkoshevoy@gmail.com> wrote:
> From: Pavel Koshevoy <pkoshevoy@gmail.com>
>
> ps.sps_list entries may be NULL, so check before dereferencing
> ---
>  libavcodec/vda_h264_dec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavcodec/vda_h264_dec.c b/libavcodec/vda_h264_dec.c
> index 92839e2..972bd6b 100644
> --- a/libavcodec/vda_h264_dec.c
> +++ b/libavcodec/vda_h264_dec.c
> @@ -226,7 +226,7 @@ static av_cold int vdadec_init(AVCodecContext *avctx)
>      ctx->h264_initialized = 1;
>
>      for (i = 0; i < MAX_SPS_COUNT; i++) {
> -        const SPS *sps = (const SPS*)ctx->h264ctx.ps.sps_list[i]->data;
> +        const SPS *sps = ctx->h264ctx.ps.sps_list[i] ? (const SPS*)ctx->h264ctx.ps.sps_list[i]->data : NULL;
>          if (sps && (sps->bit_depth_luma != 8 ||
>                  sps->chroma_format_idc == 2 ||
>                  sps->chroma_format_idc == 3)) {
> --
> 2.6.6
>


Ping.  This is a fix for a segfault I've actually run into.

    Pavel.
Michael Niedermayer Feb. 16, 2017, 12:22 p.m. UTC | #2
On Wed, Feb 15, 2017 at 10:05:56AM -0700, Pavel Koshevoy wrote:
> On Thu, Feb 9, 2017 at 8:20 PM,  <pkoshevoy@gmail.com> wrote:
> > From: Pavel Koshevoy <pkoshevoy@gmail.com>
> >
> > ps.sps_list entries may be NULL, so check before dereferencing
> > ---
> >  libavcodec/vda_h264_dec.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/libavcodec/vda_h264_dec.c b/libavcodec/vda_h264_dec.c
> > index 92839e2..972bd6b 100644
> > --- a/libavcodec/vda_h264_dec.c
> > +++ b/libavcodec/vda_h264_dec.c
> > @@ -226,7 +226,7 @@ static av_cold int vdadec_init(AVCodecContext *avctx)
> >      ctx->h264_initialized = 1;
> >
> >      for (i = 0; i < MAX_SPS_COUNT; i++) {
> > -        const SPS *sps = (const SPS*)ctx->h264ctx.ps.sps_list[i]->data;
> > +        const SPS *sps = ctx->h264ctx.ps.sps_list[i] ? (const SPS*)ctx->h264ctx.ps.sps_list[i]->data : NULL;
> >          if (sps && (sps->bit_depth_luma != 8 ||
> >                  sps->chroma_format_idc == 2 ||
> >                  sps->chroma_format_idc == 3)) {
> > --
> > 2.6.6
> >
> 
> 
> Ping.  This is a fix for a segfault I've actually run into.

applied

thx

[...]
diff mbox

Patch

diff --git a/libavcodec/vda_h264_dec.c b/libavcodec/vda_h264_dec.c
index 92839e2..972bd6b 100644
--- a/libavcodec/vda_h264_dec.c
+++ b/libavcodec/vda_h264_dec.c
@@ -226,7 +226,7 @@  static av_cold int vdadec_init(AVCodecContext *avctx)
     ctx->h264_initialized = 1;
 
     for (i = 0; i < MAX_SPS_COUNT; i++) {
-        const SPS *sps = (const SPS*)ctx->h264ctx.ps.sps_list[i]->data;
+        const SPS *sps = ctx->h264ctx.ps.sps_list[i] ? (const SPS*)ctx->h264ctx.ps.sps_list[i]->data : NULL;
         if (sps && (sps->bit_depth_luma != 8 ||
                 sps->chroma_format_idc == 2 ||
                 sps->chroma_format_idc == 3)) {