diff options
| author | Janne Grunau <janne-libav@jannau.net> | 2012-11-25 22:42:07 +0100 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2012-12-18 19:48:30 +0100 |
| commit | f1d8763a02b5fce9a7d9789e049d74a45b15e1e8 (patch) | |
| tree | c319ee271c465de1c768fb61d6f51bea0c33d465 /libavcodec/mpeg12.c | |
| parent | ed2d7d5868a4a5d914f1e5488d63ea696a3b2937 (diff) | |
mpegvideo: allocate scratch buffers after linesize is known
Since we can't know which stride a custom get_buffer() implementation is
going to use we have to allocate this scratch buffers after the linesize
is known. It was pretty safe for 8 bit per pixel pixel formats since we
always allocated memory for up to 16 bits per pixel. It broke hoever
with cmdutis.c's alloc_buffer() and high pixel bit depth since it
allocated larger edges than mpegvideo expected.
Fixes fuzzed sample nasa-8s2.ts_s244342.
Diffstat (limited to 'libavcodec/mpeg12.c')
| -rw-r--r-- | libavcodec/mpeg12.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/mpeg12.c b/libavcodec/mpeg12.c index df8afec611..83069f54cc 100644 --- a/libavcodec/mpeg12.c +++ b/libavcodec/mpeg12.c @@ -2394,7 +2394,10 @@ static int decode_chunks(AVCodecContext *avctx, thread_context->end_mb_y = s2->mb_height; if (s->slice_count) { s2->thread_context[s->slice_count-1]->end_mb_y = mb_y; - ff_update_duplicate_context(thread_context, s2); + ret = ff_update_duplicate_context(thread_context, + s2); + if (ret < 0) + return ret; } init_get_bits(&thread_context->gb, buf_ptr, input_size*8); s->slice_count++; |