diff options
| author | Anton Khirnov <anton@khirnov.net> | 2016-08-14 10:18:39 +0200 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2016-08-18 17:06:46 +0200 |
| commit | 15ee419b7abaf17f8c662c145fe93d3dbf43282b (patch) | |
| tree | 0c01f477c5f8011ed58123d5dce229aea73c3b90 /libavcodec | |
| parent | 409d1cd2c955485798f8b0b0147c2b899b9144ec (diff) | |
| download | ffmpeg-15ee419b7abaf17f8c662c145fe93d3dbf43282b.tar.gz | |
pcx: properly pad the scanline
It is passed to the get_bits API, which requires buffers to be padded.
Fixes possible invalid reads.
CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/pcx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c index aa69d510ea..77b2331f0e 100644 --- a/libavcodec/pcx.c +++ b/libavcodec/pcx.c @@ -148,7 +148,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, ptr = p->data[0]; stride = p->linesize[0]; - scanline = av_malloc(bytes_per_scanline); + scanline = av_malloc(bytes_per_scanline + AV_INPUT_BUFFER_PADDING_SIZE); if (!scanline) return AVERROR(ENOMEM); |