virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

avcodec/mpeg12dec: ensure a53_caption_size is reset on malloc failures

Browse Source 
Signed-off-by: Aman Gupta <aman@tmm1.net>
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Aman Gupta
2017-03-15 12:53:04 -07:00
parent 3f1a540204
commit ff8f40a630
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/mpeg12dec.c
View File

@@ -2235,8 +2235,11 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
av_freep(&s1->a53_caption); av_freep(&s1->a53_caption);
s1->a53_caption_size = cc_count * 3; s1->a53_caption_size = cc_count * 3;
s1->a53_caption = av_malloc(s1->a53_caption_size); s1->a53_caption = av_malloc(s1->a53_caption_size);
if (s1->a53_caption) if (!s1->a53_caption) {
s1->a53_caption_size = 0;
} else {
memcpy(s1->a53_caption, p + 7, s1->a53_caption_size); memcpy(s1->a53_caption, p + 7, s1->a53_caption_size);
}
avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS; avctx->properties |= FF_CODEC_PROPERTY_CLOSED_CAPTIONS;
} }
return 1; return 1;
@@ -2253,7 +2256,9 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
av_freep(&s1->a53_caption); av_freep(&s1->a53_caption);
s1->a53_caption_size = cc_count * 3; s1->a53_caption_size = cc_count * 3;
s1->a53_caption = av_mallocz(s1->a53_caption_size); s1->a53_caption = av_mallocz(s1->a53_caption_size);
if (s1->a53_caption) { if (!s1->a53_caption) {
s1->a53_caption_size = 0;
} else {
uint8_t field, cc1, cc2; uint8_t field, cc1, cc2;
uint8_t *cap = s1->a53_caption; uint8_t *cap = s1->a53_caption;
for (i = 0; i < cc_count && get_bits_left(&gb) >= 26; i++) { for (i = 0; i < cc_count && get_bits_left(&gb) >= 26; i++) {
@@ -2317,7 +2322,9 @@ static int mpeg_decode_a53_cc(AVCodecContext *avctx,
av_freep(&s1->a53_caption); av_freep(&s1->a53_caption);
s1->a53_caption_size = cc_count * 6; s1->a53_caption_size = cc_count * 6;
s1->a53_caption = av_malloc(s1->a53_caption_size); s1->a53_caption = av_malloc(s1->a53_caption_size);
if (s1->a53_caption) { if (!s1->a53_caption) {
s1->a53_caption_size = 0;
} else {
uint8_t field1 = !!(p[4] & 0x80); uint8_t field1 = !!(p[4] & 0x80);
uint8_t *cap = s1->a53_caption; uint8_t *cap = s1->a53_caption;
p += 5; p += 5;