diff libmpdemux/demux_real.c @ 17226:255b14c0bc36

malloc padding to avoid access beyond allocated memory Credits to Mikulas Patocka (mikulas at artax karlin mff cuni cz)

--- a/libmpdemux/demux_real.c	Mon Dec 19 18:04:37 2005 +0000
+++ b/libmpdemux/demux_real.c	Mon Dec 19 19:38:28 2005 +0000
@@ -32,6 +32,12 @@
 #include "stheader.h"
 #include "bswap.h"
 
+#ifdef USE_LIBAVCODEC
+#include "avcodec.h"
+#else
+#define FF_INPUT_BUFFER_PADDING_SIZE 8
+#endif
+
 //#define mp_dbg(mod,lev, args... ) mp_msg_c((mod<<8)|lev, ## args )
 
 #define MKTAG(a, b, c, d) (a | (b << 8) | (c << 16) | (d << 24))
@@ -921,7 +927,8 @@
 			    // increase buffer size, this should not happen!
 			    mp_msg(MSGT_DEMUX,MSGL_WARN, "chunktab buffer too small!!!!!\n");
 			    dp->len=dp_hdr->chunktab+8*(4+dp_hdr->chunks);
-			    dp->buffer=realloc(dp->buffer,dp->len);
+			    dp->buffer=realloc(dp->buffer,dp->len+FF_INPUT_BUFFER_PADDING_SIZE);
+			    memset(dp->buffer + dp->len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
 			    // re-calc pointers:
 			    dp_hdr=(dp_hdr_t*)dp->buffer;
 			    dp_data=dp->buffer+sizeof(dp_hdr_t);