# HG changeset patch # User michael # Date 1239302870 0 # Node ID 25fa07ef8e2b0800d1e0ecb7ec59a37f8fe47617 # Parent 539e18dfc86a20489f159a2e2279d9cd5d0b673b Make sure the block array is of the correct size. This might have been exploitable. diff -r 539e18dfc86a -r 25fa07ef8e2b snow.c --- a/snow.c Thu Apr 09 18:37:26 2009 +0000 +++ b/snow.c Thu Apr 09 18:47:50 2009 +0000 @@ -1626,6 +1626,7 @@ s->b_width = w; s->b_height= h; + av_free(s->block); s->block= av_mallocz(w * h * sizeof(BlockNode) << (s->block_max_depth*2)); return 0; } @@ -4517,7 +4518,7 @@ && p->hcoeff[2]==2; } - if(!s->block) alloc_blocks(s); + alloc_blocks(s); frame_start(s); //keyframe flag duplication mess FIXME