diff options
author | henry <henry@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-12-19 19:38:28 +0000 |
---|---|---|
committer | henry <henry@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2005-12-19 19:38:28 +0000 |
commit | c0e54fd248d11f41ac44756b34b47d2054d82465 (patch) | |
tree | 83ea5587981cda6ab1654d6272807d8c6e82c06f /libmpdemux/video.c | |
parent | 335f35f2bf4d6fbc7caa9a27e8f8d21f4c937477 (diff) | |
download | mpv-c0e54fd248d11f41ac44756b34b47d2054d82465.tar.bz2 mpv-c0e54fd248d11f41ac44756b34b47d2054d82465.tar.xz |
malloc padding to avoid access beyond allocated memory
Credits to Mikulas Patocka (mikulas at artax karlin mff cuni cz)
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@17227 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux/video.c')
-rw-r--r-- | libmpdemux/video.c | 39 |
1 files changed, 27 insertions, 12 deletions
diff --git a/libmpdemux/video.c b/libmpdemux/video.c index 0c73bc7774..f6bc1724f7 100644 --- a/libmpdemux/video.c +++ b/libmpdemux/video.c @@ -22,6 +22,12 @@ /* sub_cc (closed captions)*/ #include "sub_cc.h" +#ifdef USE_LIBAVCODEC +#include "avcodec.h" +#else +#define FF_INPUT_BUFFER_PADDING_SIZE 8 +#endif + /* biCompression constant */ #define BI_RGB 0L @@ -132,10 +138,13 @@ switch(video_codec){ } } mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n"); - if(!videobuffer) videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE); - if(!videobuffer){ - mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail); - return 0; + if(!videobuffer) { + videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); + if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE); + else { + mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail); + return 0; + } } mp_msg(MSGT_DECVIDEO,MSGL_V,"Searching for Video Object Layer Start code... ");fflush(stdout); while(1){ @@ -222,10 +231,13 @@ switch(video_codec){ } } mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n"); - if(!videobuffer) videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE); - if(!videobuffer){ - mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail); - return 0; + if(!videobuffer) { + videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); + if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE); + else { + mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail); + return 0; + } } pos = videobuf_len+4; if(!read_video_packet(d_video)){ @@ -280,10 +292,13 @@ switch(video_codec){ // sh_video=d_video->sh;sh_video->ds=d_video; // mpeg2_init(); // ========= Read & process sequence header & extension ============ - if(!videobuffer) videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE); - if(!videobuffer){ - mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail); - return 0; + if(!videobuffer) { + videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); + if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE); + else { + mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail); + return 0; + } } if(!read_video_packet(d_video)){ |