avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
authorMichael Niedermayer <michael@niedermayer.cc>
Sun, 8 Oct 2017 22:32:30 +0000 (00:32 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Fri, 13 Oct 2017 10:59:48 +0000 (12:59 +0200)
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)

Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 127a362630e11fe724e2e63fc871791fdcbcfa64)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/mpeg_er.c

index dd87ae9..9bd269c 100644 (file)
@@ -71,6 +71,7 @@ static void mpeg_er_decode_mb(void *opaque, int ref, int mv_dir, int mv_type,
     s->mb_skipped = mb_skipped;
     s->mb_x       = mb_x;
     s->mb_y       = mb_y;
+    s->mcsel      = 0;
     memcpy(s->mv, mv, sizeof(*mv));
 
     ff_init_block_index(s);