aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/vp3.c
diff options
context:
space:
mode:
authorMike Melanson <mike@multimedia.cx>2009-09-24 06:33:16 +0000
committerMike Melanson <mike@multimedia.cx>2009-09-24 06:33:16 +0000
commit0efbd068e72ecfdcd4b1088f8daf35fb703fb4ea (patch)
treea635dca944279f93dc57c84e2572ccde9ced7be4 /libavcodec/vp3.c
parent22da339f5ddf4a5880050e9dac60ef7c4592e443 (diff)
downloadffmpeg-0efbd068e72ecfdcd4b1088f8daf35fb703fb4ea.tar.gz
Make sure that all memory allocations succeed.
Based on 28_theora_malloc_checks.patch from the Google Chrome team. Originally committed as revision 20008 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/vp3.c')
-rw-r--r--libavcodec/vp3.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 6a6663ff3b..60b84f0b5f 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -42,6 +42,8 @@
#define FRAGMENT_PIXELS 8
+static av_cold int vp3_decode_end(AVCodecContext *avctx);
+
typedef struct Coeff {
struct Coeff *next;
DCTELEM coeff;
@@ -1755,6 +1757,11 @@ static av_cold int vp3_decode_init(AVCodecContext *avctx)
s->coeffs = av_malloc(s->fragment_count * sizeof(Coeff) * 65);
s->coded_fragment_list = av_malloc(s->fragment_count * sizeof(int));
s->pixel_addresses_initialized = 0;
+ if (!s->superblock_coding || !s->all_fragments || !s->coeff_counts ||
+ !s->coeffs || !s->coded_fragment_list) {
+ vp3_decode_end(avctx);
+ return -1;
+ }
if (!s->theora_tables)
{
@@ -1860,6 +1867,11 @@ static av_cold int vp3_decode_init(AVCodecContext *avctx)
s->superblock_macroblocks = av_malloc(s->superblock_count * 4 * sizeof(int));
s->macroblock_fragments = av_malloc(s->macroblock_count * 6 * sizeof(int));
s->macroblock_coding = av_malloc(s->macroblock_count + 1);
+ if (!s->superblock_fragments || !s->superblock_macroblocks ||
+ !s->macroblock_fragments || !s->macroblock_coding) {
+ vp3_decode_end(avctx);
+ return -1;
+ }
init_block_mapping(s);
for (i = 0; i < 3; i++) {