On Sat, 28 Jan 2012 09:36:32 +0000, Måns Rullgård <[email protected]> wrote:
> Anton Khirnov <[email protected]> writes:
> 
> > This function is video-only, so there's no point in setting more
> > linesizes.
> >
> > Fixes stack corruption in avplay.
> > ---
> >  libavcodec/utils.c |    4 ++--
> >  1 files changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/libavcodec/utils.c b/libavcodec/utils.c
> > index 707ecb5..34a4122 100644
> > --- a/libavcodec/utils.c
> > +++ b/libavcodec/utils.c
> > @@ -219,7 +219,7 @@ void avcodec_align_dimensions2(AVCodecContext *s, int 
> > *width, int *height,
> >          *height+=2; // some of the optimized chroma MC reads one line too 
> > much
> >                      // which is also done in mpeg decoders with lowres > 0
> >
> > -    for (i = 0; i < AV_NUM_DATA_POINTERS; i++)
> > +    for (i = 0; i < 4; i++)
> >          linesize_align[i] = STRIDE_ALIGN;
> >  //STRIDE_ALIGN is 8 for SSE* but this does not work for SVQ1 chroma planes
> >  //we could change STRIDE_ALIGN to 16 for x86/sse but it would increase the
> > @@ -229,7 +229,7 @@ void avcodec_align_dimensions2(AVCodecContext *s, int 
> > *width, int *height,
> >      if(s->codec_id == CODEC_ID_SVQ1 || s->codec_id == CODEC_ID_VP5 ||
> >         s->codec_id == CODEC_ID_VP6 || s->codec_id == CODEC_ID_VP6F ||
> >         s->codec_id == CODEC_ID_VP6A) {
> > -        for (i = 0; i < AV_NUM_DATA_POINTERS; i++)
> > +        for (i = 0; i < 4; i++)
> >              linesize_align[i] = 16;
> >      }
> >  #endif
> > -- 
> 
> Why does filling the array cause stack corruption in avplay?  Sounds
> like the bug is in avplay.

Strictly speaking yes, avplay passes a stride[4], when it should be
stride[AV_NUM_DATA_POINTERS]. But I expect that many our users are doing
the same, so it's more user-friendly to not overwrite their stack
unnecessarily.

-- 
Anton Khirnov
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to