# HG changeset patch
# User michael
# Date 1257171145 0
# Node ID 3e404d2520a7fc4dd0214a3cae5e8e726a94a550
# Parent  b2524430a456c7d8b5e6834a17c37566a73083a7
Avoid huge array for rgb ljpeg on the stack.
Code tested with an ljpeg i had laying around.

diff -r b2524430a456 -r 3e404d2520a7 mjpegdec.c
--- a/mjpegdec.c	Mon Nov 02 00:10:10 2009 +0000
+++ b/mjpegdec.c	Mon Nov 02 14:12:25 2009 +0000
@@ -616,13 +616,13 @@
 
 static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point_transform){
     int i, mb_x, mb_y;
-    uint16_t buffer[32768][4];
+    uint16_t (*buffer)[4];
     int left[3], top[3], topleft[3];
     const int linesize= s->linesize[0];
     const int mask= (1<<s->bits)-1;
 
-    if((unsigned)s->mb_width > 32768) //dynamic alloc
-        return -1;
+    av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size, (unsigned)s->mb_width * 4 * sizeof(s->ljpeg_buffer[0][0]));
+    buffer= s->ljpeg_buffer;
 
     for(i=0; i<3; i++){
         buffer[0][i]= 1 << (s->bits + point_transform - 1);
@@ -1504,6 +1504,8 @@
 
     av_free(s->buffer);
     av_free(s->qscale_table);
+    av_freep(&s->ljpeg_buffer);
+    s->ljpeg_buffer_size=0;
 
     for(i=0;i<2;i++) {
         for(j=0;j<4;j++)
diff -r b2524430a456 -r 3e404d2520a7 mjpegdec.h
--- a/mjpegdec.h	Mon Nov 02 00:10:10 2009 +0000
+++ b/mjpegdec.h	Mon Nov 02 14:12:25 2009 +0000
@@ -102,6 +102,9 @@
 
     int cur_scan; /* current scan, used by JPEG-LS */
     int flipped; /* true if picture is flipped */
+
+    uint16_t (*ljpeg_buffer)[4];
+    unsigned int ljpeg_buffer_size;
 } MJpegDecodeContext;
 
 int ff_mjpeg_decode_init(AVCodecContext *avctx);