[FFmpeg-devel] [libav-devel] [PATCH 3/4] dds: make sure pallete frame buffer exists before use

[Vittorio Giovara]

On Wed, Nov 11, 2015 at 1:16 AM, Andreas Cadhalpun
<andreas.cadhalpun at googlemail.com> wrote:
> Otherwise it causes a NULL pointer dereference of frame->data[1].
>
> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
> ---
>  libavcodec/dds.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/libavcodec/dds.c b/libavcodec/dds.c
> index c918cf0..fe36709 100644
> --- a/libavcodec/dds.c
> +++ b/libavcodec/dds.c
> @@ -662,6 +662,11 @@ static int dds_decode(AVCodecContext *avctx, void *data,
>
>          if (ctx->paletted) {
>              int i;
> +            if (!frame->data[1]) {
> +                av_log(avctx, AV_LOG_ERROR,
> +                       "Palette frame buffer is not allocated.\n");
> +                return AVERROR_INVALIDDATA;
> +            }
>              /* Use the first 1024 bytes as palette, then copy the rest. */
>              bytestream2_get_buffer(gbc, frame->data[1], 256 * 4);
>              for (i = 0; i < 256; i++)

how can this happen?
-- 
Vittorio