From 127a362630e11fe724e2e63fc871791fdcbcfa64 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon, 9 Oct 2017 00:32:30 +0200
Subject: [PATCH] avcodec/mpeg_er: Clear mcsel in mpeg_er_decode_mb()
Fixes out of array read
Should fix: 3516/clusterfuzz-testcase-minimized-4608518562775040 (not reprodoceable)
Found-by: Insu Yun, Georgia Tech.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/mpeg_er.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libavcodec/mpeg_er.c b/libavcodec/mpeg_er.c
index 5eca834072a..ada1a1692f3 100644
--- a/libavcodec/mpeg_er.c
+++ b/libavcodec/mpeg_er.c
@@ -71,6 +71,7 @@ static void mpeg_er_decode_mb(void *opaque, int ref, int mv_dir, int mv_type,
s->mb_skipped = mb_skipped;
s->mb_x = mb_x;
s->mb_y = mb_y;
+ s->mcsel = 0;
memcpy(s->mv, mv, sizeof(*mv));
ff_init_block_index(s);
--
GitLab