diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-23 01:21:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-21 01:52:51 +0100 |
| commit | 804e1e1610528ac8cbe9dec389e14eabde359997 (patch) | |
| tree | 434fe5461efb6d97b2b4dd200b19d12d7dc9fc44 | |
| parent | 99d2d1404c7daeac5f4c0495a44eabcc86a386e6 (diff) | |
| download | ffmpeg-804e1e1610528ac8cbe9dec389e14eabde359997.tar.gz | |
avcodec/a64multienc: don't set incorrect packet size
This fixes invalid reads of the packet buffer in av_dup_packet
Based on patch by Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d96142e9af92ded84f2580620c571ab96c4bb657)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/a64multienc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/a64multienc.c b/libavcodec/a64multienc.c index 60644a2644..889e8eb670 100644 --- a/libavcodec/a64multienc.c +++ b/libavcodec/a64multienc.c @@ -336,8 +336,8 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, req_size = 0; /* any frames to encode? */ if (c->mc_lifetime) { - req_size = charset_size + c->mc_lifetime*(screen_size + colram_size); - if ((ret = ff_alloc_packet2(avctx, pkt, req_size)) < 0) + int alloc_size = charset_size + c->mc_lifetime*(screen_size + colram_size); + if ((ret = ff_alloc_packet2(avctx, pkt, alloc_size)) < 0) return ret; buf = pkt->data; @@ -353,6 +353,7 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, /* advance pointers */ buf += charset_size; + req_size += charset_size; } /* write x frames to buf */ |