diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-11 21:29:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-12 03:23:55 +0100 |
| commit | ee3c3dd523623e0d9e69aa2ce268fef82b201458 (patch) | |
| tree | 2911df6d519be9ec7a1a16cb9b66c8faef7cfc1f | |
| parent | 9e73f6d1f9a242ea0b2fdb3bf22890d2a4422be0 (diff) | |
| download | ffmpeg-ee3c3dd523623e0d9e69aa2ce268fef82b201458.tar.gz | |
ff_alloc_picture: free tables in case of dimension mismatches
Fixes memory corruption
In theory this should not be needed but its better to check at
one place than to hope 50 other places set the flags correctly
| -rw-r--r-- | libavcodec/mpegvideo.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index 9fe93bf4ab..d0c8262fde 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -411,6 +411,11 @@ int ff_alloc_picture(MpegEncContext *s, Picture *pic, int shared) { int i, ret; + if (pic->qscale_table_buf) + if (pic->mbskip_table_buf->size < s->mb_stride * s->mb_height + 2 || + pic->qscale_table_buf->size < s->mb_stride * (s->mb_height + 1) + 1 + s->mb_stride) + free_picture_tables(pic); + if (shared) { assert(pic->f.data[0]); pic->shared = 1; |