aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/utils.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2014-03-18 00:07:53 +0100
committerMichael Niedermayer <michaelni@gmx.at>2014-03-18 02:03:30 +0100
commit8ab80707841a73ca7708e1e1aa97f3513fff3d35 (patch)
tree4ee837326989f9e832a153927a0e2861d062a3ac /libavcodec/utils.c
parentaa1f38015cb0d04a5c50a8957dd7aba79f0d8882 (diff)
downloadffmpeg-8ab80707841a73ca7708e1e1aa97f3513fff3d35.tar.gz
avcodec/utils: fix sizeof(AVFrame) dependence in avcodec_encode_audio2()
This is a bit tricky, we allocate a correctly sized AVFrame but then only copy the compile time AVFrame size, this is to ensure that user applications which do not use the correct av frame API dont end with out of array reads. Note, applications using the correct API have set extended_data and the changed code will never be executed for them. Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/utils.c')
-rw-r--r--libavcodec/utils.c18
1 files changed, 12 insertions, 6 deletions
diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index 11b874f764..cd04ca2aaf 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -1615,7 +1615,7 @@ int attribute_align_arg avcodec_encode_audio2(AVCodecContext *avctx,
const AVFrame *frame,
int *got_packet_ptr)
{
- AVFrame tmp;
+ AVFrame *extended_frame = NULL;
AVFrame *padded_frame = NULL;
int ret;
AVPacket user_pkt = *avpkt;
@@ -1640,9 +1640,13 @@ int attribute_align_arg avcodec_encode_audio2(AVCodecContext *avctx,
}
av_log(avctx, AV_LOG_WARNING, "extended_data is not set.\n");
- tmp = *frame;
- tmp.extended_data = tmp.data;
- frame = &tmp;
+ extended_frame = av_frame_alloc();
+ if (!extended_frame)
+ return AVERROR(ENOMEM);
+
+ memcpy(extended_frame, frame, sizeof(AVFrame));
+ extended_frame->extended_data = extended_frame->data;
+ frame = extended_frame;
}
/* check for valid frame size */
@@ -1650,14 +1654,15 @@ int attribute_align_arg avcodec_encode_audio2(AVCodecContext *avctx,
if (avctx->codec->capabilities & CODEC_CAP_SMALL_LAST_FRAME) {
if (frame->nb_samples > avctx->frame_size) {
av_log(avctx, AV_LOG_ERROR, "more samples than frame size (avcodec_encode_audio2)\n");
- return AVERROR(EINVAL);
+ ret = AVERROR(EINVAL);
+ goto end;
}
} else if (!(avctx->codec->capabilities & CODEC_CAP_VARIABLE_FRAME_SIZE)) {
if (frame->nb_samples < avctx->frame_size &&
!avctx->internal->last_audio_frame) {
ret = pad_last_frame(avctx, &padded_frame, frame);
if (ret < 0)
- return ret;
+ goto end;
frame = padded_frame;
avctx->internal->last_audio_frame = 1;
@@ -1729,6 +1734,7 @@ int attribute_align_arg avcodec_encode_audio2(AVCodecContext *avctx,
end:
av_frame_free(&padded_frame);
+ av_free(extended_frame);
return ret;
}