diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-30 23:45:01 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-30 23:50:32 +0100 |
| commit | a084884b628fd9cbfe965b7ac37e59202d708c26 (patch) | |
| tree | 195893497dcccf92cf19c9c48b8c64a08d4f99fa | |
| parent | 0dcfccaa691bf533b0f144b6d98b49eb59f1f3ab (diff) | |
| download | ffmpeg-a084884b628fd9cbfe965b7ac37e59202d708c26.tar.gz | |
flashsv: clear blocks array on reallocation
Fixes use of uninitialized data
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/flashsv.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/libavcodec/flashsv.c b/libavcodec/flashsv.c index 7855416567..21464ed6b4 100644 --- a/libavcodec/flashsv.c +++ b/libavcodec/flashsv.c @@ -245,6 +245,8 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data, FlashSVContext *s = avctx->priv_data; int h_blocks, v_blocks, h_part, v_part, i, j; GetBitContext gb; + int last_blockwidth = s->block_width; + int last_blockheight= s->block_height; /* no supplementary picture */ if (buf_size == 0) @@ -260,6 +262,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data, s->block_height = 16 * (get_bits(&gb, 4) + 1); s->image_height = get_bits(&gb, 12); + if ( last_blockwidth != s->block_width + || last_blockheight!= s->block_height) + av_freep(&s->blocks); + if (s->ver == 2) { skip_bits(&gb, 6); if (get_bits1(&gb)) { @@ -323,9 +329,8 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data, s->keyframedata = av_realloc(s->keyframedata, avpkt->size); memcpy(s->keyframedata, avpkt->data, avpkt->size); } - if(s->ver == 2) - s->blocks = av_realloc(s->blocks, - (v_blocks + !!v_part) * (h_blocks + !!h_part) + if(s->ver == 2 && !s->blocks) + s->blocks = av_mallocz((v_blocks + !!v_part) * (h_blocks + !!h_part) * sizeof(s->blocks[0])); av_dlog(avctx, "image: %dx%d block: %dx%d num: %dx%d part: %dx%d\n", |