diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-23 01:21:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-14 14:27:23 +0100 |
| commit | 5c4dc00c3a6d8403a881fc810dc38ae861a1eef4 (patch) | |
| tree | fe9bbf8104935570f10da357dd22f2602271a591 | |
| parent | baa1738f99187fc2c6ce16e5e79d45d1eb555d63 (diff) | |
| download | ffmpeg-5c4dc00c3a6d8403a881fc810dc38ae861a1eef4.tar.gz | |
avcodec/a64multienc: don't set incorrect packet size
This fixes invalid reads of the packet buffer in av_dup_packet
Based on patch by Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d96142e9af92ded84f2580620c571ab96c4bb657)
Conflicts:
libavcodec/a64multienc.c
| -rw-r--r-- | libavcodec/a64multienc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/a64multienc.c b/libavcodec/a64multienc.c index 89cd2f5571..0cdec2ec62 100644 --- a/libavcodec/a64multienc.c +++ b/libavcodec/a64multienc.c @@ -336,8 +336,8 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, req_size = 0; /* any frames to encode? */ if (c->mc_lifetime) { - req_size = charset_size + c->mc_lifetime*(screen_size + colram_size); - if ((ret = ff_alloc_packet2(avctx, pkt, req_size)) < 0) + int alloc_size = charset_size + c->mc_lifetime*(screen_size + colram_size); + if ((ret = ff_alloc_packet2(avctx, pkt, alloc_size)) < 0) return ret; buf = pkt->data; @@ -354,6 +354,7 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, /* advance pointers */ buf += charset_size; charset += charset_size; + req_size += charset_size; } /* write x frames to buf */ |