Hi, we encountered a crash with an interlaced MPEG-2 video due to overflow of an under-allocated scratch buffer.
Minimal sample (not safe for work, sorry) at http://geraldine.fjfi.cvut.cz/~makovicka/test.vob . The overflow can be verified using Valgrind. MPV_decode_mb_internal needs 3 * 16 * linesize bytes of scratch buffer For interlaced content, linesize is multiplied by two after the allocation of the scratch buffer, and the dest_cr pointer currently ends past the buffer. This patch makes ff_mpv_frame_size_alloc allocate a total of (aligned line_size) * 2 * 16 * 3 bytes, which suffices even for the interlaced case. -- Jindřich Makovička
0001-mpegvideo-allocate-sufficiently-large-scratch-buffer.patch
Description: Binary data
_______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
