Mercurial > libavcodec.hg

changeset 5522:acaaff7b6fb8 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
ensure that default_get_buffer() doesnt reuse images if the dimension or pix_fmt changed fixes heap overflow, possibly exploitable
author michael
date Fri, 10 Aug 2007 19:28:28 +0000
parents 6232e9874f46
children c2ab2ac31edb
files utils.c
diffstat 1 files changed, 12 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/utils.c	Fri Aug 10 19:23:14 2007 +0000
+++ b/utils.c	Fri Aug 10 19:28:28 2007 +0000
@@ -147,6 +147,8 @@
     uint8_t *base[4];
     uint8_t *data[4];
     int linesize[4];
+    int width, height;
+    enum PixelFormat pix_fmt;
 }InternalBuffer;
 
 #define INTERNAL_BUFFER_SIZE 32
@@ -251,6 +253,13 @@
     picture_number= &(((InternalBuffer*)s->internal_buffer)[INTERNAL_BUFFER_SIZE-1]).last_pic_num; //FIXME ugly hack
     (*picture_number)++;
 
+    if(buf->base[0] && (buf->width != w || buf->height != h || buf->pix_fmt != s->pix_fmt)){
+        for(i=0; i<4; i++){
+            av_freep(&buf->base[i]);
+            buf->data[i]= NULL;
+        }
+    }
+
     if(buf->base[0]){
         pic->age= *picture_number - buf->last_pic_num;
         buf->last_pic_num= *picture_number;
@@ -306,6 +315,9 @@
             else
                 buf->data[i] = buf->base[i] + ALIGN((buf->linesize[i]*EDGE_WIDTH>>v_shift) + (EDGE_WIDTH>>h_shift), STRIDE_ALIGN);
         }
+        buf->width  = s->width;
+        buf->height = s->height;
+        buf->pix_fmt= s->pix_fmt;
         pic->age= 256*256*256*64;
     }
     pic->type= FF_BUFFER_TYPE_INTERNAL;