Mercurial > libavcodec.hg
comparison h264.c @ 6173:11d2976cddc4 libavcodec
Fix crash for CAVLC->CABAC switch caused by writing into NULL tables.
(iam not sure if this might have been exploitable)
fixes issue332 / CVCANLMA2_Sony_C.jsv
Other solutions which waste a few bytes less are welcome ...
| author | michael |
|---|---|
| date | Thu, 24 Jan 2008 19:31:59 +0000 |
| parents | 13aa4cac4dde |
| children | 2aa536e36c89 |
comparison
equal
deleted
inserted
replaced
| 6172:13aa4cac4dde | 6173:11d2976cddc4 |
|---|---|
| 2033 | 2033 |
| 2034 CHECKED_ALLOCZ(h->non_zero_count , big_mb_num * 16 * sizeof(uint8_t)) | 2034 CHECKED_ALLOCZ(h->non_zero_count , big_mb_num * 16 * sizeof(uint8_t)) |
| 2035 CHECKED_ALLOCZ(h->slice_table_base , (big_mb_num+s->mb_stride) * sizeof(uint8_t)) | 2035 CHECKED_ALLOCZ(h->slice_table_base , (big_mb_num+s->mb_stride) * sizeof(uint8_t)) |
| 2036 CHECKED_ALLOCZ(h->cbp_table, big_mb_num * sizeof(uint16_t)) | 2036 CHECKED_ALLOCZ(h->cbp_table, big_mb_num * sizeof(uint16_t)) |
| 2037 | 2037 |
| 2038 if( h->pps.cabac ) { | |
| 2039 CHECKED_ALLOCZ(h->chroma_pred_mode_table, big_mb_num * sizeof(uint8_t)) | 2038 CHECKED_ALLOCZ(h->chroma_pred_mode_table, big_mb_num * sizeof(uint8_t)) |
| 2040 CHECKED_ALLOCZ(h->mvd_table[0], 32*big_mb_num * sizeof(uint16_t)); | 2039 CHECKED_ALLOCZ(h->mvd_table[0], 32*big_mb_num * sizeof(uint16_t)); |
| 2041 CHECKED_ALLOCZ(h->mvd_table[1], 32*big_mb_num * sizeof(uint16_t)); | 2040 CHECKED_ALLOCZ(h->mvd_table[1], 32*big_mb_num * sizeof(uint16_t)); |
| 2042 CHECKED_ALLOCZ(h->direct_table, 32*big_mb_num * sizeof(uint8_t)); | 2041 CHECKED_ALLOCZ(h->direct_table, 32*big_mb_num * sizeof(uint8_t)); |
| 2043 } | |
| 2044 | 2042 |
| 2045 memset(h->slice_table_base, -1, (big_mb_num+s->mb_stride) * sizeof(uint8_t)); | 2043 memset(h->slice_table_base, -1, (big_mb_num+s->mb_stride) * sizeof(uint8_t)); |
| 2046 h->slice_table= h->slice_table_base + s->mb_stride*2 + 1; | 2044 h->slice_table= h->slice_table_base + s->mb_stride*2 + 1; |
| 2047 | 2045 |
| 2048 CHECKED_ALLOCZ(h->mb2b_xy , big_mb_num * sizeof(uint32_t)); | 2046 CHECKED_ALLOCZ(h->mb2b_xy , big_mb_num * sizeof(uint32_t)); |