diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-23 01:21:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-02-23 01:49:23 +0100 |
| commit | d96142e9af92ded84f2580620c571ab96c4bb657 (patch) | |
| tree | 9887223d665ac060c009408a3f14c3c5a5fbd4d5 | |
| parent | 39e4ed7c1d8d840be47f6d604704d47a59a9ae5d (diff) | |
| download | ffmpeg-d96142e9af92ded84f2580620c571ab96c4bb657.tar.gz | |
avcodec/a64multienc: don't set incorrect packet size
This fixes invalid reads of the packet buffer in av_dup_packet
Based on patch by Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/a64multienc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/a64multienc.c b/libavcodec/a64multienc.c index dfb4414157..16fb2d6190 100644 --- a/libavcodec/a64multienc.c +++ b/libavcodec/a64multienc.c @@ -336,8 +336,8 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, req_size = 0; /* any frames to encode? */ if (c->mc_lifetime) { - req_size = charset_size + c->mc_lifetime*(screen_size + colram_size); - if ((ret = ff_alloc_packet2(avctx, pkt, req_size)) < 0) + int alloc_size = charset_size + c->mc_lifetime*(screen_size + colram_size); + if ((ret = ff_alloc_packet2(avctx, pkt, alloc_size)) < 0) return ret; buf = pkt->data; @@ -359,6 +359,7 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, /* advance pointers */ buf += charset_size; + req_size += charset_size; } /* write x frames to buf */ |