virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-29 22:00:58 +02:00
Code Issues Releases Activity

avcodec/diracdec: move mc buffer allocation to per frame

Browse Source 
Fixes out of array accesses for non default buffers with large strides

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-05-19 06:19:23 +02:00
parent 76191c08f8
commit 4a30f08505
1 changed files with 35 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
libavcodec/diracdec.c
View File

@ -201,6 +201,7 @@ typedef struct DiracContext {
uint16_t *mctmp; /* buffer holding the MC data multipled by OBMC weights */ uint16_t *mctmp; /* buffer holding the MC data multipled by OBMC weights */
uint8_t *mcscratch; uint8_t *mcscratch;
int buffer_stride;
DECLARE_ALIGNED(16, uint8_t, obmc_weight)[3][MAX_BLOCKSIZE*MAX_BLOCKSIZE]; DECLARE_ALIGNED(16, uint8_t, obmc_weight)[3][MAX_BLOCKSIZE*MAX_BLOCKSIZE];
@ -343,22 +344,44 @@ static int alloc_sequence_buffers(DiracContext *s)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
} }
w = s->source.width;
h = s->source.height;
/* fixme: allocate using real stride here */ /* fixme: allocate using real stride here */
s->sbsplit = av_malloc_array(sbwidth, sbheight); s->sbsplit = av_malloc_array(sbwidth, sbheight);
s->blmotion = av_malloc_array(sbwidth, sbheight * 16 * sizeof(*s->blmotion)); s->blmotion = av_malloc_array(sbwidth, sbheight * 16 * sizeof(*s->blmotion));
s->edge_emu_buffer_base = av_malloc_array((w+64), MAX_BLOCKSIZE);
s->mctmp = av_malloc_array((w+64+MAX_BLOCKSIZE), (h+MAX_BLOCKSIZE) * sizeof(*s->mctmp)); if (!s->sbsplit || !s->blmotion)
s->mcscratch = av_malloc_array((w+64), MAX_BLOCKSIZE);
if (!s->sbsplit || !s->blmotion || !s->mctmp || !s->mcscratch)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);
return 0; return 0;
} }
static int alloc_buffers(DiracContext *s, int stride)
{
int w = s->source.width;
int h = s->source.height;
av_assert0(stride >= w);
stride += 64;
if (s->buffer_stride >= stride)
return 0;
s->buffer_stride = 0;
av_freep(&s->edge_emu_buffer_base);
memset(s->edge_emu_buffer, 0, sizeof(s->edge_emu_buffer));
av_freep(&s->mctmp);
av_freep(&s->mcscratch);
s->edge_emu_buffer_base = av_malloc_array(stride, MAX_BLOCKSIZE);
s->mctmp = av_malloc_array((stride+MAX_BLOCKSIZE), (h+MAX_BLOCKSIZE) * sizeof(*s->mctmp));
s->mcscratch = av_malloc_array(stride, MAX_BLOCKSIZE);
if (!s->edge_emu_buffer_base || !s->mctmp || !s->mcscratch)
return AVERROR(ENOMEM);
s->buffer_stride = stride;
return 0;
}
static void free_sequence_buffers(DiracContext *s) static void free_sequence_buffers(DiracContext *s)
{ {
int i, j, k; int i, j, k;
@ -382,6 +405,7 @@ static void free_sequence_buffers(DiracContext *s)
av_freep(&s->plane[i].idwt_tmp); av_freep(&s->plane[i].idwt_tmp);
} }
s->buffer_stride = 0;
av_freep(&s->sbsplit); av_freep(&s->sbsplit);
av_freep(&s->blmotion); av_freep(&s->blmotion);
av_freep(&s->edge_emu_buffer_base); av_freep(&s->edge_emu_buffer_base);
@ -1854,6 +1878,9 @@ static int dirac_decode_data_unit(AVCodecContext *avctx, const uint8_t *buf, int
s->plane[1].stride = pic->avframe->linesize[1]; s->plane[1].stride = pic->avframe->linesize[1];
s->plane[2].stride = pic->avframe->linesize[2]; s->plane[2].stride = pic->avframe->linesize[2];
if (alloc_buffers(s, FFMAX3(FFABS(s->plane[0].stride), FFABS(s->plane[1].stride), FFABS(s->plane[2].stride))) < 0)
return AVERROR(ENOMEM);
/* [DIRAC_STD] 11.1 Picture parse. picture_parse() */ /* [DIRAC_STD] 11.1 Picture parse. picture_parse() */
if (dirac_decode_picture_header(s)) if (dirac_decode_picture_header(s))
return -1; return -1;