virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/libopenh264dec: Increase array sizes, fix stack-buffer overread

Browse Source 
av_image_copy() expects an array of four pointers and linesizes
according to its declaration; it currently only pointers that are
actually in use (depending upon the pixel format), but this might
change at any time. It has already happened for the linesizes in
d7bc52bf45 and so increasing their
array fixes a stack-buffer overread.

This fixes a -Wstringop-overflow= and -Wstringop-overread warning
from GCC 11.2.

Reviewed-by: Linjie Fu <linjie.justin.fu@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit b0b90100bf)
This commit is contained in:
Andreas Rheinhardt 2021-12-06 12:20:21 +01:00
parent d1f7a44e89
commit 0066e79c9e
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/libopenh264dec.c
View File

@ -91,8 +91,8 @@ static int svc_decode_frame(AVCodecContext *avctx, void *data,
{
SVCContext *s = avctx->priv_data;
SBufferInfo info = { 0 };
uint8_t* ptrs[3];
int ret, linesize[3];
uint8_t *ptrs[4] = { NULL };
int ret, linesize[4];
AVFrame *avframe = data;
DECODING_STATE state;
#if OPENH264_VER_AT_LEAST(1, 7)
@ -140,6 +140,7 @@ static int svc_decode_frame(AVCodecContext *avctx, void *data,
linesize[0] = info.UsrData.sSystemBuffer.iStride[0];
linesize[1] = linesize[2] = info.UsrData.sSystemBuffer.iStride[1];
linesize[3] = 0;
av_image_copy(avframe->data, avframe->linesize, (const uint8_t **) ptrs, linesize, avctx->pix_fmt, avctx->width, avctx->height);
avframe->pts = info.uiOutYuvTimeStamp;