virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-21 10:55:51 +02:00
Code Issues Releases Activity

jpeg2000: fix dereferencing invalid pointers during cleanup

Browse Source 
CC: libav-stable@libav.org
Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Vittorio Giovara <vittorio.giovara@gmail.com>
This commit is contained in:
Vittorio Giovara 2014-03-09 18:52:40 +01:00
parent ab72eda15e
commit 10306e9c5f
1 changed files with 23 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
libavcodec/jpeg2000.c
View File

@ -229,7 +229,7 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
if (!comp->i_data)
return AVERROR(ENOMEM);
}
comp->reslevel = av_malloc_array(codsty->nreslevels, sizeof(*comp->reslevel));
comp->reslevel = av_mallocz_array(codsty->nreslevels, sizeof(*comp->reslevel));
if (!comp->reslevel)
return AVERROR(ENOMEM);
/* LOOP on resolution levels */
@ -277,7 +277,7 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
reslevel->log2_prec_height) -
(reslevel->coord[1][0] >> reslevel->log2_prec_height);
reslevel->band = av_malloc_array(reslevel->nbands, sizeof(*reslevel->band));
reslevel->band = av_mallocz_array(reslevel->nbands, sizeof(*reslevel->band));
if (!reslevel->band)
return AVERROR(ENOMEM);
@ -373,9 +373,9 @@ int ff_jpeg2000_init_component(Jpeg2000Component *comp,
for (j = 0; j < 2; j++)
band->coord[1][j] = ff_jpeg2000_ceildiv(band->coord[1][j], dy);
band->prec = av_malloc_array(reslevel->num_precincts_x *
reslevel->num_precincts_y,
sizeof(*band->prec));
band->prec = av_mallocz_array(reslevel->num_precincts_x *
reslevel->num_precincts_y,
sizeof(*band->prec));
if (!band->prec)
return AVERROR(ENOMEM);
@ -488,15 +488,30 @@ void ff_jpeg2000_cleanup(Jpeg2000Component *comp, Jpeg2000CodingStyle *codsty)
for (reslevelno = 0;
comp->reslevel && reslevelno < codsty->nreslevels;
reslevelno++) {
Jpeg2000ResLevel *reslevel = comp->reslevel + reslevelno;
Jpeg2000ResLevel *reslevel;
if (!comp->reslevel)
continue;
reslevel = comp->reslevel + reslevelno;
for (bandno = 0; bandno < reslevel->nbands; bandno++) {
Jpeg2000Band *band = reslevel->band + bandno;
Jpeg2000Band *band;
if (!reslevel->band)
continue;
band = reslevel->band + bandno;
for (precno = 0; precno < reslevel->num_precincts_x * reslevel->num_precincts_y; precno++) {
Jpeg2000Prec *prec = band->prec + precno;
Jpeg2000Prec *prec;
if (!band->prec)
continue;
prec = band->prec + precno;
av_freep(&prec->zerobits);
av_freep(&prec->cblkincl);
av_freep(&prec->cblk);
}
av_freep(&band->prec);