har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flashsv: clear blocks array on reallocation

Browse Source 
Fixes use of uninitialized data

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-30 23:45:01 +01:00
parent 0dcfccaa69
commit a084884b62
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/flashsv.c
View File

@ -245,6 +245,8 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
FlashSVContext *s = avctx->priv_data; FlashSVContext *s = avctx->priv_data;
int h_blocks, v_blocks, h_part, v_part, i, j; int h_blocks, v_blocks, h_part, v_part, i, j;
GetBitContext gb; GetBitContext gb;
int last_blockwidth = s->block_width;
int last_blockheight= s->block_height;
/* no supplementary picture */ /* no supplementary picture */
if (buf_size == 0) if (buf_size == 0)
@ -260,6 +262,10 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
s->block_height = 16 * (get_bits(&gb, 4) + 1); s->block_height = 16 * (get_bits(&gb, 4) + 1);
s->image_height = get_bits(&gb, 12); s->image_height = get_bits(&gb, 12);
if ( last_blockwidth != s->block_width
|| last_blockheight!= s->block_height)
av_freep(&s->blocks);
if (s->ver == 2) { if (s->ver == 2) {
skip_bits(&gb, 6); skip_bits(&gb, 6);
if (get_bits1(&gb)) { if (get_bits1(&gb)) {
@ -323,9 +329,8 @@ static int flashsv_decode_frame(AVCodecContext *avctx, void *data,
s->keyframedata = av_realloc(s->keyframedata, avpkt->size); s->keyframedata = av_realloc(s->keyframedata, avpkt->size);
memcpy(s->keyframedata, avpkt->data, avpkt->size); memcpy(s->keyframedata, avpkt->data, avpkt->size);
} }
if(s->ver == 2) if(s->ver == 2 && !s->blocks)
s->blocks = av_realloc(s->blocks, s->blocks = av_mallocz((v_blocks + !!v_part) * (h_blocks + !!h_part)
(v_blocks + !!v_part) * (h_blocks + !!h_part)
* sizeof(s->blocks[0])); * sizeof(s->blocks[0]));
av_dlog(avctx, "image: %dx%d block: %dx%d num: %dx%d part: %dx%d\n", av_dlog(avctx, "image: %dx%d block: %dx%d num: %dx%d part: %dx%d\n",