[FFmpeg-cvslog] avcodec/vc1dec: field pictures with direct mode MBs, followed by frame pictures are not supported

[Michael Niedermayer]

ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Sat Feb  1 05:34:25 2014 +0100| [9368b91834e46149f6b97ba3dd3648e3f79edef2] | committer: Michael Niedermayer

avcodec/vc1dec: field pictures with direct mode MBs, followed by frame pictures are not supported

This case could occur when cuting and concatenating bitstreams

Fixes out of array read
Fixes: asan_heap-oob_1b33fdd_2849_cov_478905890_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 85d51d8e327c666ac963acf25cf6a6763e6c6671)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=9368b91834e46149f6b97ba3dd3648e3f79edef2
---

 libavcodec/vc1dec.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c
index 2604a95..018f1d9 100644
--- a/libavcodec/vc1dec.c
+++ b/libavcodec/vc1dec.c
@@ -4342,6 +4342,10 @@ static void vc1_decode_b_mb_intfi(VC1Context *v)
             if (bmvtype == BMV_TYPE_DIRECT) {
                 dmv_x[0] = dmv_y[0] = pred_flag[0] = 0;
                 dmv_x[1] = dmv_y[1] = pred_flag[0] = 0;
+                if (!s->next_picture_ptr->field_picture) {
+                    av_log(s->avctx, AV_LOG_ERROR, "Mixed field/frame direct mode not supported\n");
+                    return;
+                }
             }
             vc1_pred_b_mv_intfi(v, 0, dmv_x, dmv_y, 1, pred_flag);
             vc1_b_mc(v, dmv_x, dmv_y, (bmvtype == BMV_TYPE_DIRECT), bmvtype);
@@ -6028,6 +6032,7 @@ static int vc1_decode_frame(AVCodecContext *avctx, void *data,
         goto err;
     }
 
+    v->s.current_picture_ptr->field_picture = v->field_mode;
     v->s.current_picture_ptr->f.interlaced_frame = (v->fcm != PROGRESSIVE);
     v->s.current_picture_ptr->f.top_field_first  = v->tff;