generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix heap overflow with -async.

Browse Source 
Fixes issue1666

Originally committed as revision 21390 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Michael Niedermayer 2010-01-23 01:25:19 +00:00
parent e62a55b92e
commit 7a086a852c
1 changed files with 8 additions and 5 deletions

11
ffmpeg.c

@ -563,6 +563,7 @@ static void do_audio_out(AVFormatContext *s,
{ {
uint8_t *buftmp; uint8_t *buftmp;
int64_t audio_out_size, audio_buf_size; int64_t audio_out_size, audio_buf_size;
int64_t allocated_for_size= size;
int size_out, frame_bytes, ret; int size_out, frame_bytes, ret;
AVCodecContext *enc= ost->st->codec; AVCodecContext *enc= ost->st->codec;
@ -571,7 +572,8 @@ static void do_audio_out(AVFormatContext *s,
int isize= av_get_bits_per_sample_format(dec->sample_fmt)/8; int isize= av_get_bits_per_sample_format(dec->sample_fmt)/8;
const int coded_bps = av_get_bits_per_sample(enc->codec->id); const int coded_bps = av_get_bits_per_sample(enc->codec->id);
audio_buf_size= (size + isize*dec->channels - 1) / (isize*dec->channels); need_realloc:
audio_buf_size= (allocated_for_size + isize*dec->channels - 1) / (isize*dec->channels);
audio_buf_size= (audio_buf_size*enc->sample_rate + dec->sample_rate) / dec->sample_rate; audio_buf_size= (audio_buf_size*enc->sample_rate + dec->sample_rate) / dec->sample_rate;
audio_buf_size= audio_buf_size*2 + 10000; //safety factors for the deprecated resampling API audio_buf_size= audio_buf_size*2 + 10000; //safety factors for the deprecated resampling API
audio_buf_size*= osize*enc->channels; audio_buf_size*= osize*enc->channels;
@ -649,10 +651,11 @@ static void do_audio_out(AVFormatContext *s,
static uint8_t *input_tmp= NULL; static uint8_t *input_tmp= NULL;
input_tmp= av_realloc(input_tmp, byte_delta + size); input_tmp= av_realloc(input_tmp, byte_delta + size);
if(byte_delta + size <= MAX_AUDIO_PACKET_SIZE) if(byte_delta > allocated_for_size - size){
allocated_for_size= byte_delta + (int64_t)size;
goto need_realloc;
}
ist->is_start=0; ist->is_start=0;
else
byte_delta= MAX_AUDIO_PACKET_SIZE - size;
memset(input_tmp, 0, byte_delta); memset(input_tmp, 0, byte_delta);
memcpy(input_tmp + byte_delta, buf, size); memcpy(input_tmp + byte_delta, buf, size);