From f1d8763a02b5fce9a7d9789e049d74a45b15e1e8 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Sun, 25 Nov 2012 22:42:07 +0100 Subject: mpegvideo: allocate scratch buffers after linesize is known Since we can't know which stride a custom get_buffer() implementation is going to use we have to allocate this scratch buffers after the linesize is known. It was pretty safe for 8 bit per pixel pixel formats since we always allocated memory for up to 16 bits per pixel. It broke hoever with cmdutis.c's alloc_buffer() and high pixel bit depth since it allocated larger edges than mpegvideo expected. Fixes fuzzed sample nasa-8s2.ts_s244342. --- libavcodec/mpeg12.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'libavcodec/mpeg12.c') diff --git a/libavcodec/mpeg12.c b/libavcodec/mpeg12.c index df8afec..83069f5 100644 --- a/libavcodec/mpeg12.c +++ b/libavcodec/mpeg12.c @@ -2394,7 +2394,10 @@ static int decode_chunks(AVCodecContext *avctx, thread_context->end_mb_y = s2->mb_height; if (s->slice_count) { s2->thread_context[s->slice_count-1]->end_mb_y = mb_y; - ff_update_duplicate_context(thread_context, s2); + ret = ff_update_duplicate_context(thread_context, + s2); + if (ret < 0) + return ret; } init_get_bits(&thread_context->gb, buf_ptr, input_size*8); s->slice_count++; -- cgit v1.1