diff options
| author | Paul B Mahol <onemda@gmail.com> | 2023-09-11 01:07:44 +0200 |
|---|---|---|
| committer | Paul B Mahol <onemda@gmail.com> | 2023-09-11 01:14:50 +0200 |
| commit | 86bd0f08d3ea3dfdd523a1b1ac9e52545641c443 (patch) | |
| tree | 41b5e3e351af5e041660fd7be755a6538b73f3fe | |
| parent | 64f538c356b22922663a6a6d3d0a062ae574dc44 (diff) | |
| download | ffmpeg-86bd0f08d3ea3dfdd523a1b1ac9e52545641c443.tar.gz | |
avcodec/vmixdec: fix inputs with more than 255 slices
| -rw-r--r-- | libavcodec/vmixdec.c | 18 |
1 files changed, 14 insertions, 4 deletions
diff --git a/libavcodec/vmixdec.c b/libavcodec/vmixdec.c index 4cc5963e25..149bb0083d 100644 --- a/libavcodec/vmixdec.c +++ b/libavcodec/vmixdec.c @@ -49,7 +49,8 @@ typedef struct VMIXContext { int16_t factors[64]; uint8_t scan[64]; - SliceContext slices[255]; + SliceContext *slices; + unsigned int slices_size; IDCTDSPContext idsp; } VMIXContext; @@ -225,9 +226,10 @@ static int decode_frame(AVCodecContext *avctx, for (int n = 0; n < 64; n++) s->factors[n] = quant[n] * quality[q]; - s->nb_slices = avpkt->data[2]; - if (!s->nb_slices || s->nb_slices > (avctx->height + 15) / 16) - return AVERROR_INVALIDDATA; + s->nb_slices = (avctx->height + 15) / 16; + av_fast_mallocz(&s->slices, &s->slices_size, s->nb_slices * sizeof(*s->slices)); + if (!s->slices) + return AVERROR(ENOMEM); for (int n = 0; n < s->nb_slices; n++) { unsigned slice_size; @@ -279,6 +281,13 @@ static int decode_frame(AVCodecContext *avctx, return avpkt->size; } +static av_cold int decode_end(AVCodecContext *avctx) +{ + VMIXContext *s = avctx->priv_data; + av_freep(&s->slices); + return 0; +} + const FFCodec ff_vmix_decoder = { .p.name = "vmix", CODEC_LONG_NAME("vMix Video"), @@ -286,6 +295,7 @@ const FFCodec ff_vmix_decoder = { .p.id = AV_CODEC_ID_VMIX, .priv_data_size = sizeof(VMIXContext), .init = decode_init, + .close = decode_end, FF_CODEC_DECODE_CB(decode_frame), .p.capabilities = AV_CODEC_CAP_DR1 | AV_CODEC_CAP_FRAME_THREADS | AV_CODEC_CAP_SLICE_THREADS, |