diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-24 14:25:52 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-06 00:55:36 +0200 |
| commit | 6736de0ce628a2799ea4d1150b7a92a80f09c45a (patch) | |
| tree | 5e59747d56baf18fa65d451a8081f9bac94a2259 | |
| parent | fe8508b948d045fbc02b2d81c305d9b445953be4 (diff) | |
| download | ffmpeg-6736de0ce628a2799ea4d1150b7a92a80f09c45a.tar.gz | |
mpegvideo: increase buffer sizes.
Fixes buffer overflow
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2c0559d5e2faeafa7998173a4dc430408475503f)
| -rw-r--r-- | libavcodec/mpegvideo.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index a02a77d16f..16803a00e6 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -422,12 +422,12 @@ static int init_duplicate_context(MpegEncContext *s, MpegEncContext *base) // edge emu needs blocksize + filter length - 1 // (= 17x17 for halfpel / 21x21 for h264) FF_ALLOCZ_OR_GOTO(s->avctx, s->edge_emu_buffer, - (s->width + 64) * 2 * 21 * 2, fail); // (width + edge + align)*interlaced*MBsize*tolerance + (s->width + 95) * 2 * 21 * 4, fail); // (width + edge + align)*interlaced*MBsize*tolerance // FIXME should be linesize instead of s->width * 2 // but that is not known before get_buffer() FF_ALLOCZ_OR_GOTO(s->avctx, s->me.scratchpad, - (s->width + 64) * 4 * 16 * 2 * sizeof(uint8_t), fail) + (s->width + 95) * 4 * 16 * 2 * sizeof(uint8_t), fail) s->me.temp = s->me.scratchpad; s->rd_scratchpad = s->me.scratchpad; s->b_scratchpad = s->me.scratchpad; |