[FFmpeg-cvslog] bink: Prevent NULL dereferences with missing reference frame

[Laurent Aimar]

ffmpeg | branch: release/0.8 | Laurent Aimar <fenrir at videolan.org> | Tue Sep 27 22:15:31 2011 +0000| [c5766b55c41c702cf0961253e737b86fe7c28308] | committer: Reinhard Tartler

bink: Prevent NULL dereferences with missing reference frame

Signed-off-by: Janne Grunau <janne-libav at jannau.net>
(cherry picked from commit c7e631986b4a326a71a20a1a51000f3fbf6e64e7)

Signed-off-by: Anton Khirnov <anton at khirnov.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c5766b55c41c702cf0961253e737b86fe7c28308
---

 libavcodec/bink.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/libavcodec/bink.c b/libavcodec/bink.c
index e085aa5..4f30618 100644
--- a/libavcodec/bink.c
+++ b/libavcodec/bink.c
@@ -948,8 +948,9 @@ static int bink_decode_plane(BinkContext *c, GetBitContext *gb, int plane_idx,
     for (i = 0; i < BINK_NB_SRC; i++)
         read_bundle(gb, c, i);
 
-    ref_start = c->last.data[plane_idx];
-    ref_end   = c->last.data[plane_idx]
+    ref_start = c->last.data[plane_idx] ? c->last.data[plane_idx]
+                                        : c->pic.data[plane_idx];
+    ref_end   = ref_start
                 + (bw - 1 + c->last.linesize[plane_idx] * (bh - 1)) * 8;
 
     for (i = 0; i < 64; i++)
@@ -978,7 +979,8 @@ static int bink_decode_plane(BinkContext *c, GetBitContext *gb, int plane_idx,
         if (by == bh)
             break;
         dst  = c->pic.data[plane_idx]  + 8*by*stride;
-        prev = c->last.data[plane_idx] + 8*by*stride;
+        prev = (c->last.data[plane_idx] ? c->last.data[plane_idx]
+                                        : c->pic.data[plane_idx]) + 8*by*stride;
         for (bx = 0; bx < bw; bx++, dst += 8, prev += 8) {
             blk = get_value(c, BINK_SRC_BLOCK_TYPES);
             // 16x16 block type on odd line means part of the already decoded block, so skip it