On 13/08/13 13:13, Kostya Shishkov wrote: > On Tue, Aug 13, 2013 at 07:08:26AM +0200, Luca Barbato wrote: >> The decompressed buffer can be used after codec_reinit, so it must be >> preserved. >> >> Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind >> CC: [email protected] >> --- >> libavcodec/nuv.c | 14 +++++++++----- >> 1 file changed, 9 insertions(+), 5 deletions(-) >> >> diff --git a/libavcodec/nuv.c b/libavcodec/nuv.c >> index 086e57c..7398f8c 100644 >> --- a/libavcodec/nuv.c >> +++ b/libavcodec/nuv.c >> @@ -120,18 +120,20 @@ static int codec_reinit(AVCodecContext *avctx, int >> width, int height, >> if (quality >= 0) >> get_quant_quality(c, quality); >> if (width != c->width || height != c->height) { >> + void *ptr; >> if ((ret = av_image_check_size(height, width, 0, avctx)) < 0) >> return ret; >> avctx->width = c->width = width; >> avctx->height = c->height = height; >> - av_fast_malloc(&c->decomp_buf, &c->decomp_size, >> - c->height * c->width * 3 / 2 + >> - FF_INPUT_BUFFER_PADDING_SIZE); >> - if (!c->decomp_buf) { >> + ptr = av_fast_realloc(c->decomp_buf, &c->decomp_size, >> + c->height * c->width * 3 / 2 + >> + FF_INPUT_BUFFER_PADDING_SIZE); >> + if (!ptr) { >> av_log(avctx, AV_LOG_ERROR, >> "Can't allocate decompression buffer.\n"); >> return AVERROR(ENOMEM); >> - } >> + } else >> + c->decomp_buf = ptr; >> ff_rtjpeg_decode_init(&c->rtj, &c->dsp, c->width, c->height, >> c->lq, c->cq); >> av_frame_unref(&c->pic); >> @@ -222,6 +224,8 @@ static int decode_frame(AVCodecContext *avctx, void >> *data, int *got_frame, >> q = buf[10]; >> if ((result = codec_reinit(avctx, w, h, q)) < 0) >> return result; >> + if (comptype == NUV_RTJPEG_IN_LZO || comptype == NUV_LZO) >> + buf = c->decomp_buf; > > hmm, so in this case decomp_buf is expected to have RTJPEG_HEADER_SIZE bytes > for the header? Why is not in realloc? Otherwise LGTM
Actually you found yet another corner case that would lead to a crash if not checked, thank you =) lu _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
