videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

rawdec: allocate a buffer in the appropriate size in the copy case. 

Otherwise the created buffer can be smaller than buf_size, which results
in buffer overreads if the original image has extra padding on every line.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Hendrik Leppkes 2013-06-16 09:46:17 +02:00 committed by Michael Niedermayer
parent 359af6a7c7
commit 8962da9ec3
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/rawdec.c
View File

@ -190,7 +190,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
return res; return res;
if (need_copy) if (need_copy)
frame->buf[0] = av_buffer_alloc(context->frame_size); frame->buf[0] = av_buffer_alloc(FFMAX(context->frame_size, buf_size));
else else
frame->buf[0] = av_buffer_ref(avpkt->buf); frame->buf[0] = av_buffer_ref(avpkt->buf);
if (!frame->buf[0]) if (!frame->buf[0])
@ -219,7 +219,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
} }
buf = dst; buf = dst;
} else if (need_copy) { } else if (need_copy) {
memcpy(frame->buf[0]->data, buf, FFMIN(buf_size, context->frame_size)); memcpy(frame->buf[0]->data, buf, buf_size);
buf = frame->buf[0]->data; buf = frame->buf[0]->data;
} }