vlc | branch: master | Francois Cartegnie <[email protected]> | Mon Dec 24 12:05:13 2018 +0100| [876450978c00d5fff966f1aef691e0bc185b154c] | committer: Francois Cartegnie
codec: jpeg: set row_pointers on context fixes potential invalid deref on jpeg error/longjmp > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=876450978c00d5fff966f1aef691e0bc185b154c --- modules/codec/jpeg.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/modules/codec/jpeg.c b/modules/codec/jpeg.c index 5f50f80819..788a6d78c6 100644 --- a/modules/codec/jpeg.c +++ b/modules/codec/jpeg.c @@ -70,6 +70,7 @@ typedef struct { JPEG_SYS_COMMON_MEMBERS + JSAMPARRAY p_row_pointers; struct jpeg_decompress_struct p_jpeg; } decoder_sys_t; @@ -500,7 +501,7 @@ static int DecodeBlock(decoder_t *p_dec, block_t *p_block) decoder_sys_t *p_sys = p_dec->p_sys; picture_t *p_pic = 0; - JSAMPARRAY p_row_pointers = NULL; + p_sys->p_row_pointers = NULL; if (!p_block) /* No Drain */ return VLCDEC_SUCCESS; @@ -553,25 +554,25 @@ static int DecodeBlock(decoder_t *p_dec, block_t *p_block) } /* Decode picture */ - p_row_pointers = vlc_alloc(p_sys->p_jpeg.output_height, sizeof(JSAMPROW)); - if (!p_row_pointers) + p_sys->p_row_pointers = vlc_alloc(p_sys->p_jpeg.output_height, sizeof(JSAMPROW)); + if (!p_sys->p_row_pointers) { goto error; } for (unsigned i = 0; i < p_sys->p_jpeg.output_height; i++) { - p_row_pointers[i] = p_pic->p->p_pixels + p_pic->p->i_pitch * i; + p_sys->p_row_pointers[i] = p_pic->p->p_pixels + p_pic->p->i_pitch * i; } while (p_sys->p_jpeg.output_scanline < p_sys->p_jpeg.output_height) { jpeg_read_scanlines(&p_sys->p_jpeg, - p_row_pointers + p_sys->p_jpeg.output_scanline, + p_sys->p_row_pointers + p_sys->p_jpeg.output_scanline, p_sys->p_jpeg.output_height - p_sys->p_jpeg.output_scanline); } jpeg_finish_decompress(&p_sys->p_jpeg); jpeg_destroy_decompress(&p_sys->p_jpeg); - free(p_row_pointers); + free(p_sys->p_row_pointers); p_pic->date = p_block->i_pts != VLC_TICK_INVALID ? p_block->i_pts : p_block->i_dts; @@ -582,7 +583,7 @@ static int DecodeBlock(decoder_t *p_dec, block_t *p_block) error: jpeg_destroy_decompress(&p_sys->p_jpeg); - free(p_row_pointers); + free(p_sys->p_row_pointers); block_Release(p_block); return VLCDEC_SUCCESS; _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
