diff options
author | henry <henry@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-12-19 19:38:28 +0000 |
---|---|---|
committer | henry <henry@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-12-19 19:38:28 +0000 |
commit | c0e54fd248d11f41ac44756b34b47d2054d82465 (patch) | |
tree | 83ea5587981cda6ab1654d6272807d8c6e82c06f /libmpcodecs | |
parent | 335f35f2bf4d6fbc7caa9a27e8f8d21f4c937477 (diff) | |
download | mpv-c0e54fd248d11f41ac44756b34b47d2054d82465.tar.bz2 mpv-c0e54fd248d11f41ac44756b34b47d2054d82465.tar.xz |
malloc padding to avoid access beyond allocated memory
Credits to Mikulas Patocka (mikulas at artax karlin mff cuni cz)
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@17227 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpcodecs')
-rw-r--r-- | libmpcodecs/ad_ffmpeg.c | 2 | ||||
-rw-r--r-- | libmpcodecs/vd_ffmpeg.c | 8 |
2 files changed, 5 insertions, 5 deletions
diff --git a/libmpcodecs/ad_ffmpeg.c b/libmpcodecs/ad_ffmpeg.c index d1132d43f1..0f8d667c26 100644 --- a/libmpcodecs/ad_ffmpeg.c +++ b/libmpcodecs/ad_ffmpeg.c @@ -73,7 +73,7 @@ static int init(sh_audio_t *sh_audio) /* alloc extra data */ if (sh_audio->wf && sh_audio->wf->cbSize > 0) { - lavc_context->extradata = av_malloc(sh_audio->wf->cbSize); + lavc_context->extradata = av_mallocz(sh_audio->wf->cbSize + FF_INPUT_BUFFER_PADDING_SIZE); lavc_context->extradata_size = sh_audio->wf->cbSize; memcpy(lavc_context->extradata, (char *)sh_audio->wf + sizeof(WAVEFORMATEX), lavc_context->extradata_size); diff --git a/libmpcodecs/vd_ffmpeg.c b/libmpcodecs/vd_ffmpeg.c index e2ed1a323b..76615ee4af 100644 --- a/libmpcodecs/vd_ffmpeg.c +++ b/libmpcodecs/vd_ffmpeg.c @@ -324,7 +324,7 @@ static int init(sh_video_t *sh){ { avctx->flags |= CODEC_FLAG_EXTERN_HUFF; avctx->extradata_size = sh->bih->biSize-sizeof(BITMAPINFOHEADER); - avctx->extradata = av_malloc(avctx->extradata_size); + avctx->extradata = av_mallocz(avctx->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); memcpy(avctx->extradata, sh->bih+sizeof(BITMAPINFOHEADER), avctx->extradata_size); @@ -346,7 +346,7 @@ static int init(sh_video_t *sh){ || sh->format == mmioFOURCC('R', 'V', '4', '0') ){ avctx->extradata_size= 8; - avctx->extradata = av_malloc(avctx->extradata_size); + avctx->extradata = av_mallocz(avctx->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); if(sh->bih->biSize!=sizeof(*sh->bih)+8){ /* only 1 packet per frame & sub_id from fourcc */ ((uint32_t*)avctx->extradata)[0] = 0; @@ -384,7 +384,7 @@ static int init(sh_video_t *sh){ )) { avctx->extradata_size = sh->bih->biSize-sizeof(BITMAPINFOHEADER); - avctx->extradata = av_malloc(avctx->extradata_size); + avctx->extradata = av_mallocz(avctx->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); memcpy(avctx->extradata, sh->bih+1, avctx->extradata_size); } /* Pass palette to codec */ @@ -405,7 +405,7 @@ static int init(sh_video_t *sh){ if (sh->ImageDesc && sh->format == mmioFOURCC('S','V','Q','3')){ avctx->extradata_size = (*(int*)sh->ImageDesc) - sizeof(int); - avctx->extradata = av_malloc(avctx->extradata_size); + avctx->extradata = av_mallocz(avctx->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); memcpy(avctx->extradata, ((int*)sh->ImageDesc)+1, avctx->extradata_size); } |