diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-23 01:21:30 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-10 02:13:09 +0200 |
| commit | ffdfa80147f3f534185e2b9dd9327b9bd48417ec (patch) | |
| tree | 0f1df23847e01b003e36b71d188a60a70e05d64e | |
| parent | c4353d7ee2039296b2a9ecb2907db7805c6ab1d3 (diff) | |
| download | ffmpeg-ffdfa80147f3f534185e2b9dd9327b9bd48417ec.tar.gz | |
avcodec/a64multienc: don't set incorrect packet size
This fixes invalid reads of the packet buffer in av_dup_packet
Based on patch by Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d96142e9af92ded84f2580620c571ab96c4bb657)
Conflicts:
libavcodec/a64multienc.c
| -rw-r--r-- | libavcodec/a64multienc.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/a64multienc.c b/libavcodec/a64multienc.c index a97c641c63..a2b4837990 100644 --- a/libavcodec/a64multienc.c +++ b/libavcodec/a64multienc.c @@ -334,8 +334,8 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, req_size = 0; /* any frames to encode? */ if (c->mc_lifetime) { - req_size = charset_size + c->mc_lifetime*(screen_size + colram_size); - if ((ret = ff_alloc_packet2(avctx, pkt, req_size)) < 0) + int alloc_size = charset_size + c->mc_lifetime*(screen_size + colram_size); + if ((ret = ff_alloc_packet2(avctx, pkt, alloc_size)) < 0) return ret; buf = pkt->data; @@ -352,6 +352,7 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, /* advance pointers */ buf += charset_size; charset += charset_size; + req_size += charset_size; } /* write x frames to buf */ |