generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

lcl: don't overwrite input memory.

Browse Source 
If the PNG filter is enabled, a PNG-style filter will run over the
input buffer, writing into the buffer. Therefore, if no zlib compression
was used, ensure that we copy into a temporary buffer, otherwise we
overwrite user-provided input data.
This commit is contained in:
Ronald S. Bultje 2012-02-22 14:22:56 -08:00
parent 1d8c4af396
commit 01cb62aba2
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/lcldec.c
View File

@ -236,9 +236,14 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
* gives a file with ZLIB fourcc, but frame is really uncompressed. * gives a file with ZLIB fourcc, but frame is really uncompressed.
* To be sure that's true check also frame size */ * To be sure that's true check also frame size */
if (c->compression == COMP_ZLIB_NORMAL && c->imgtype == IMGTYPE_RGB24 && if (c->compression == COMP_ZLIB_NORMAL && c->imgtype == IMGTYPE_RGB24 &&
len == width * height * 3) len == width * height * 3) {
break; if (c->flags & FLAG_PNGFILTER) {
if (c->flags & FLAG_MULTITHREAD) { memcpy(c->decomp_buf, encoded, len);
encoded = c->decomp_buf;
} else {
break;
}
} else if (c->flags & FLAG_MULTITHREAD) {
int ret; int ret;
mthread_inlen = AV_RL32(encoded); mthread_inlen = AV_RL32(encoded);
mthread_inlen = FFMIN(mthread_inlen, len - 8); mthread_inlen = FFMIN(mthread_inlen, len - 8);