10l (use before malloc)

Originally committed as revision 1768 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/h263dec.c

@@ -643,14 +643,21 @@ retry:
 
     ff_er_frame_start(s);
     
+    //the second part of the wmv2 header contains the MB skip bits which are stored in current_picture->mb_type
+    //which isnt available before MPV_frame_start()
+    if (s->msmpeg4_version==5){
+        if(ff_wmv2_decode_secondary_picture_header(s) < 0)
+            return -1;
+    }
+
     /* decode each macroblock */
     s->mb_x=0; 
     s->mb_y=0;
     
     decode_slice(s);
-    while(s->mb_y<s->mb_height && s->gb.size_in_bits - get_bits_count(&s->gb)>16){
+    while(s->mb_y<s->mb_height){
         if(s->msmpeg4_version){
-            if(s->mb_x!=0 || (s->mb_y%s->slice_height)!=0)
+            if(s->mb_x!=0 || (s->mb_y%s->slice_height)!=0 || get_bits_count(&s->gb) > s->gb.size_in_bits)
                 break;
         }else{
             if(ff_h263_resync(s)<0)
@@ -733,7 +740,6 @@ retry:
         *pict= *(AVFrame*)&s->last_picture;
         ff_print_debug_info(s, s->last_picture_ptr);
     }
-    
 
     /* Return the Picture timestamp as the frame number */
     /* we substract 1 because it is added on utils.c    */

libavcodec/wmv2.c

@@ -349,7 +349,7 @@ static int decode_ext_header(Wmv2Context *w){
 int ff_wmv2_decode_picture_header(MpegEncContext * s)
 {
     Wmv2Context * const w= (Wmv2Context*)s;
-    int code, i;
+    int code;
 
 #if 0
 {
@@ -370,6 +370,15 @@ return -1;
         printf("I7:%X/\n", code);
     }
     s->qscale = get_bits(&s->gb, 5);
+    if(s->qscale < 0)
+       return -1;
+       
+    return 0;
+}
+
+int ff_wmv2_decode_secondary_picture_header(MpegEncContext * s)
+{
+    Wmv2Context * const w= (Wmv2Context*)s;
 
     if (s->pict_type == I_TYPE) {
         if(w->j_type_bit) w->j_type= get_bits1(&s->gb);