---

Not yet tested, sending as RFC...

 libavcodec/eatgv.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/libavcodec/eatgv.c b/libavcodec/eatgv.c
index c400b56..2b10a45 100644
--- a/libavcodec/eatgv.c
+++ b/libavcodec/eatgv.c
@@ -151,7 +151,7 @@ static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
     int num_blocks_raw;
     int num_blocks_packed;
     int vector_bits;
-    int i,j,x,y;
+    int i, j, x, y, err;
     GetBitContext gb;
     int mvbits;
     const uint8_t *blocks_raw;
@@ -173,16 +173,14 @@ static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
 
     /* allocate codebook buffers as necessary */
     if (num_mvs > s->num_mvs) {
-        s->mv_codebook = av_realloc(s->mv_codebook, num_mvs*2*sizeof(int));
+        if ((err = av_reallocp(&s->mv_codebook, num_mvs * 
sizeof(*s->mv_codebook))) < 0)
+            goto error;
         s->num_mvs = num_mvs;
     }
 
     if (num_blocks_packed > s->num_blocks_packed) {
-        int err;
-        if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 
0) {
-            s->num_blocks_packed = 0;
-            return err;
-        }
+        if ((err = av_reallocp(&s->block_codebook, num_blocks_packed * 16)) < 
0)
+            goto error;
         s->num_blocks_packed = num_blocks_packed;
     }
 
@@ -252,6 +250,13 @@ static int tgv_decode_inter(TgvContext *s, AVFrame *frame,
     }
 
     return 0;
+
+error:
+    av_freep(&s->mv_codebook);
+    av_freep(&s->block_codebook);
+    s->num_blocks_packed = 0;
+    s->num_mvs           = 0;
+    return err;
 }
 
 static int tgv_decode_frame(AVCodecContext *avctx,
@@ -321,10 +326,8 @@ static int tgv_decode_frame(AVCodecContext *avctx,
         }
         frame->key_frame = 0;
         frame->pict_type = AV_PICTURE_TYPE_P;
-        if (tgv_decode_inter(s, frame, buf, buf_end) < 0) {
-            av_log(avctx, AV_LOG_WARNING, "truncated inter frame\n");
-            return AVERROR_INVALIDDATA;
-        }
+        if ((ret = tgv_decode_inter(s, frame, buf, buf_end)) < 0)
+            return ret;
     }
 
     av_frame_unref(s->last_frame);
-- 
2.1.0

_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to