summaryrefslogtreecommitdiff
path: root/libavcodec/lagarith.c
diff options
context:
space:
mode:
authorAnton Khirnov <anton@khirnov.net>2013-11-28 10:54:35 +0100
committerAnton Khirnov <anton@khirnov.net>2014-02-04 22:00:27 +0100
commit4c3e1956ee35fdcc5ffdb28782050164b4623c0b (patch)
treeb144927f3c2dab2a0cccd9e0607a2c4420050861 /libavcodec/lagarith.c
parent2240e2078d53d3cfce8ff1dda64e58fa72038602 (diff)
downloadffmpeg-4c3e1956ee35fdcc5ffdb28782050164b4623c0b.tar.gz
lagarith: reallocate rgb_planes when needed
Fixes invalid writes on pixel format changes. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org
Diffstat (limited to 'libavcodec/lagarith.c')
-rw-r--r--libavcodec/lagarith.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 292d952a7d..2814e2d4f8 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -52,6 +52,7 @@ typedef struct LagarithContext {
int zeros; /**< number of consecutive zero bytes encountered */
int zeros_rem; /**< number of zero bytes remaining to output */
uint8_t *rgb_planes;
+ int rgb_planes_allocated;
int rgb_stride;
} LagarithContext;
@@ -564,13 +565,12 @@ static int lag_decode_frame(AVCodecContext *avctx,
offs[1] = offset_gu;
offs[2] = offset_ry;
+ l->rgb_stride = FFALIGN(avctx->width, 16);
+ av_fast_malloc(&l->rgb_planes, &l->rgb_planes_allocated,
+ l->rgb_stride * avctx->height * planes + 1);
if (!l->rgb_planes) {
- l->rgb_stride = FFALIGN(avctx->width, 16);
- l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 1);
- if (!l->rgb_planes) {
- av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
- return AVERROR(ENOMEM);
- }
+ av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
+ return AVERROR(ENOMEM);
}
for (i = 0; i < planes; i++)
srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;