diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-24 14:25:52 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-24 14:54:12 +0100 |
| commit | 2c0559d5e2faeafa7998173a4dc430408475503f (patch) | |
| tree | 9e4e775fa62fa1b134d40f315d32a1070d7a566b | |
| parent | 8a20774a24bb1ea68b7360113746eac6e59ad8a8 (diff) | |
| download | ffmpeg-2c0559d5e2faeafa7998173a4dc430408475503f.tar.gz | |
mpegvideo: increase buffer sizes.
Fixes buffer overflow
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/mpegvideo.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index 017bbdfba1..4f6868df9c 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -420,12 +420,12 @@ static int init_duplicate_context(MpegEncContext *s, MpegEncContext *base) // edge emu needs blocksize + filter length - 1 // (= 17x17 for halfpel / 21x21 for h264) FF_ALLOCZ_OR_GOTO(s->avctx, s->edge_emu_buffer, - (s->width + 64) * 2 * 21 * 2, fail); // (width + edge + align)*interlaced*MBsize*tolerance + (s->width + 95) * 2 * 21 * 4, fail); // (width + edge + align)*interlaced*MBsize*tolerance // FIXME should be linesize instead of s->width * 2 // but that is not known before get_buffer() FF_ALLOCZ_OR_GOTO(s->avctx, s->me.scratchpad, - (s->width + 64) * 4 * 16 * 2 * sizeof(uint8_t), fail) + (s->width + 95) * 4 * 16 * 2 * sizeof(uint8_t), fail) s->me.temp = s->me.scratchpad; s->rd_scratchpad = s->me.scratchpad; s->b_scratchpad = s->me.scratchpad; |