Module: libav Branch: master Commit: 01cb62aba2503b4173f101154f9f840f04f9c7f8
Author: Ronald S. Bultje <[email protected]> Committer: Ronald S. Bultje <[email protected]> Date: Wed Feb 22 14:22:56 2012 -0800 lcl: don't overwrite input memory. If the PNG filter is enabled, a PNG-style filter will run over the input buffer, writing into the buffer. Therefore, if no zlib compression was used, ensure that we copy into a temporary buffer, otherwise we overwrite user-provided input data. --- libavcodec/lcldec.c | 11 ++++++++--- 1 files changed, 8 insertions(+), 3 deletions(-) diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index b66a3ce..a7f0bde 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -236,9 +236,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac * gives a file with ZLIB fourcc, but frame is really uncompressed. * To be sure that's true check also frame size */ if (c->compression == COMP_ZLIB_NORMAL && c->imgtype == IMGTYPE_RGB24 && - len == width * height * 3) - break; - if (c->flags & FLAG_MULTITHREAD) { + len == width * height * 3) { + if (c->flags & FLAG_PNGFILTER) { + memcpy(c->decomp_buf, encoded, len); + encoded = c->decomp_buf; + } else { + break; + } + } else if (c->flags & FLAG_MULTITHREAD) { int ret; mthread_inlen = AV_RL32(encoded); mthread_inlen = FFMIN(mthread_inlen, len - 8); _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
