diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2025-08-21 19:06:03 +0200 |
|---|---|---|
| committer | michaelni <michael@niedermayer.cc> | 2025-08-21 21:02:40 +0000 |
| commit | c41a70b6bb79707e1e3a4b0e31950cd986b9f50e (patch) | |
| tree | febeffddf33e2015fa94431e0fd64282397d3319 | |
| parent | d4e28917afb82548fe830448033068c080cafd02 (diff) | |
| download | ffmpeg-c41a70b6bb79707e1e3a4b0e31950cd986b9f50e.tar.gz | |
avcodec/sanm: Eliminate reference into reallocated frame
AFAIK the original decoder uses the frame buffers in very strange ways
our implementation seems to mimic that and that results in the
bitstream input to point into a frame buffer while code then
parses that and potentially reallocates the frame buffer
leaving pointers hanging into dealllocated space
This simply uses a temporary buffer
Fixes: Writing into freed buffers
Fixes: BIGSLEEP-440183164/old_codec21.anim
Fixes: BIGSLEEP-440183164/old_codec4.anim
Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/sanm.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c index 28fdcb3659..051acc9057 100644 --- a/libavcodec/sanm.c +++ b/libavcodec/sanm.c @@ -1847,8 +1847,13 @@ static int process_ftch(SANMVideoContext *ctx, int size) *(int16_t *)(sf + 4 + 4) = av_le2ne16(top + yoff); /* decode the stored FOBJ */ - bytestream2_init(&gb, sf + 4, sz); + uint8_t *bitstream = av_malloc(sz + AV_INPUT_BUFFER_PADDING_SIZE); + if (!bitstream) + return AVERROR(ENOMEM); + memcpy(bitstream, sf + 4, sz); + bytestream2_init(&gb, bitstream, sz); ret = process_frame_obj(ctx, &gb); + av_free(bitstream); /* now restore the original left/top values again */ *(int16_t *)(sf + 4 + 2) = av_le2ne16(left); |