diff options
| author | Hendrik Leppkes <h.leppkes@gmail.com> | 2013-06-16 09:46:17 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-06-16 09:50:16 +0200 |
| commit | 8962da9ec367b535f975c876643ed2cad2bad32e (patch) | |
| tree | 97284e93e630d5126e54b904080d6eb542e7910b /libavcodec/rawdec.c | |
| parent | 359af6a7c74a0231d217b4102af03e1d75f3167a (diff) | |
rawdec: allocate a buffer in the appropriate size in the copy case.
Otherwise the created buffer can be smaller than buf_size, which results
in buffer overreads if the original image has extra padding on every line.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/rawdec.c')
| -rw-r--r-- | libavcodec/rawdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 46992427be..ab3e0c7f00 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -190,7 +190,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, return res; if (need_copy) - frame->buf[0] = av_buffer_alloc(context->frame_size); + frame->buf[0] = av_buffer_alloc(FFMAX(context->frame_size, buf_size)); else frame->buf[0] = av_buffer_ref(avpkt->buf); if (!frame->buf[0]) @@ -219,7 +219,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame, } buf = dst; } else if (need_copy) { - memcpy(frame->buf[0]->data, buf, FFMIN(buf_size, context->frame_size)); + memcpy(frame->buf[0]->data, buf, buf_size); buf = frame->buf[0]->data; } |