har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flashsv: Initialize the block array

Browse Source 
Otherwise flashsv2_prime could be fed random data.

Bug-Id: 908
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Luca Barbato 2015-11-01 04:07:48 +01:00
parent de41b555cd
commit 50d2a3b5f3
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/flashsv.c
View File

@ -339,12 +339,14 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
s->is_keyframe = (avpkt->flags & AV_PKT_FLAG_KEY) && (s->ver == 2); s->is_keyframe = (avpkt->flags & AV_PKT_FLAG_KEY) && (s->ver == 2);
if (s->is_keyframe) { if (s->is_keyframe) {
int err; int err;
int nb_blocks = (v_blocks + !!v_part) *
(h_blocks + !!h_part) * sizeof(s->blocks[0]);
if ((err = av_reallocp(&s->keyframedata, avpkt->size)) < 0) if ((err = av_reallocp(&s->keyframedata, avpkt->size)) < 0)
return err; return err;
memcpy(s->keyframedata, avpkt->data, avpkt->size); memcpy(s->keyframedata, avpkt->data, avpkt->size);
if ((err = av_reallocp(&s->blocks, (v_blocks + !!v_part) * if ((err = av_reallocp(&s->blocks, nb_blocks)) < 0)
(h_blocks + !!h_part) * sizeof(s->blocks[0]))) < 0)
return err; return err;
memset(s->blocks, 0, nb_blocks);
} }
ff_dlog(avctx, "image: %dx%d block: %dx%d num: %dx%d part: %dx%d\n", ff_dlog(avctx, "image: %dx%d block: %dx%d num: %dx%d part: %dx%d\n",