Fixes reading from freed data
Fixes part of Ticket3539

Signed-off-by: Michael Niedermayer <michae...@gmx.at>
---
 libavformat/swfdec.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index 0f78b17..ca2a1c4 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -353,11 +353,15 @@ static int swf_read_packet(AVFormatContext *s, AVPacket 
*pkt)
                 avpriv_set_pts_info(vst, 64, 256, swf->frame_rate);
                 st = vst;
             }
-            st->codec->width  = width;
-            st->codec->height = height;
 
             if ((res = av_new_packet(pkt, out_len - colormapsize * 
colormapbpp)) < 0)
                 goto bitmap_end;
+            if (!st->codec->width && !st->codec->height) {
+                st->codec->width  = width;
+                st->codec->height = height;
+            } else {
+                ff_add_param_change(pkt, 0, 0, 0, width, height);
+            }
             pkt->pos = pos;
             pkt->stream_index = st->index;
 
-- 
1.7.9.5

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Reply via email to