diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2012-01-17 22:20:23 +0100 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2012-01-18 21:22:01 +0100 |
| commit | f9ced97543daf4a34a31bc4d5b1cd898ded11abd (patch) | |
| tree | 29fc02d34b9f51568d494ead70198dcdf653d95a | |
| parent | 4259d1eb99bf74e75806e0f460a1e099cce81e2d (diff) | |
| download | ffmpeg-f9ced97543daf4a34a31bc4d5b1cd898ded11abd.tar.gz | |
Use av_fast_padded_malloc in fraps and mpc decoders.
Fixes FATE failures due to uninitialized reads under valgrind
for these two codecs.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
| -rw-r--r-- | libavcodec/fraps.c | 2 | ||||
| -rw-r--r-- | libavcodec/mpc.h | 2 | ||||
| -rw-r--r-- | libavcodec/mpc7.c | 20 |
3 files changed, 17 insertions, 7 deletions
diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c index de98da72ea..8a47aee456 100644 --- a/libavcodec/fraps.c +++ b/libavcodec/fraps.c @@ -277,7 +277,7 @@ static int decode_frame(AVCodecContext *avctx, offs[planes] = buf_size; for(i = 0; i < planes; i++){ is_chroma = !!i; - av_fast_malloc(&s->tmpbuf, &s->tmpbuf_size, offs[i + 1] - offs[i] - 1024 + FF_INPUT_BUFFER_PADDING_SIZE); + av_fast_padded_malloc(&s->tmpbuf, &s->tmpbuf_size, offs[i + 1] - offs[i] - 1024); if (!s->tmpbuf) return AVERROR(ENOMEM); if(fraps2_decode_plane(s, f->data[i], f->linesize[i], avctx->width >> is_chroma, diff --git a/libavcodec/mpc.h b/libavcodec/mpc.h index 8b4deef689..808739fcc9 100644 --- a/libavcodec/mpc.h +++ b/libavcodec/mpc.h @@ -66,6 +66,8 @@ typedef struct { int buf_size; AVLFG rnd; int frames_to_skip; + uint8_t *buffer; + int buffer_size; /* for synthesis */ DECLARE_ALIGNED(16, MPA_INT, synth_buf)[MPA_MAX_CHANNELS][512*2]; int synth_buf_offset[MPA_MAX_CHANNELS]; diff --git a/libavcodec/mpc7.c b/libavcodec/mpc7.c index 7393250971..0bde329e08 100644 --- a/libavcodec/mpc7.c +++ b/libavcodec/mpc7.c @@ -203,7 +203,6 @@ static int mpc7_decode_frame(AVCodecContext * avctx, void *data, int buf_size = avpkt->size; MPCContext *c = avctx->priv_data; GetBitContext gb; - uint8_t *bits; int i, ch; int mb = -1; Band *bands = c->bands; @@ -223,9 +222,11 @@ static int mpc7_decode_frame(AVCodecContext * avctx, void *data, return ret; } - bits = av_malloc(((buf_size - 1) & ~3) + FF_INPUT_BUFFER_PADDING_SIZE); - c->dsp.bswap_buf((uint32_t*)bits, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2); - init_get_bits(&gb, bits, (buf_size - 4)* 8); + av_fast_padded_malloc(&c->buffer, &c->buffer_size, FFALIGN(buf_size - 1, 4)); + if (!c->buffer) + return AVERROR(ENOMEM); + c->dsp.bswap_buf((uint32_t*)c->buffer, (const uint32_t*)(buf + 4), (buf_size - 4) >> 2); + init_get_bits(&gb, c->buffer, (buf_size - 4)* 8); skip_bits_long(&gb, buf[0]); /* read subband indexes */ @@ -282,8 +283,6 @@ static int mpc7_decode_frame(AVCodecContext * avctx, void *data, ff_mpc_dequantize_and_synth(c, mb, c->frame.data[0], 2); - av_free(bits); - bits_used = get_bits_count(&gb); bits_avail = (buf_size - 4) * 8; if(!buf[1] && ((bits_avail < bits_used) || (bits_used + 32 <= bits_avail))){ @@ -310,12 +309,21 @@ static void mpc7_decode_flush(AVCodecContext *avctx) c->frames_to_skip = 32; } +static av_cold int mpc7_decode_close(AVCodecContext *avctx) +{ + MPCContext *c = avctx->priv_data; + av_freep(&c->buffer); + c->buffer_size = 0; + return 0; +} + AVCodec ff_mpc7_decoder = { .name = "mpc7", .type = AVMEDIA_TYPE_AUDIO, .id = CODEC_ID_MUSEPACK7, .priv_data_size = sizeof(MPCContext), .init = mpc7_decode_init, + .close = mpc7_decode_close, .decode = mpc7_decode_frame, .flush = mpc7_decode_flush, .capabilities = CODEC_CAP_DR1, |