From 6a1aa5cb26479eda12320e9b9ced9cc058bf5b33 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Sat, 8 Dec 2012 16:20:18 +0100 Subject: [PATCH 1/2] mjpeg: initialize input padding after unescaped buffer to zero Fixes valgrind --undef-value-errors=yes warnings caused by valid overreads in the fate vsynth jpegls, cover-art-ape and cover-art-wv tests. --- libavcodec/mjpegdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 104a63d5fd..0b22bca5f3 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1387,6 +1387,8 @@ int ff_mjpeg_find_marker(MJpegDecodeContext *s, } *unescaped_buf_ptr = s->buffer; *unescaped_buf_size = dst - s->buffer; + memset(s->buffer + *unescaped_buf_size, 0, + FF_INPUT_BUFFER_PADDING_SIZE); av_log(s->avctx, AV_LOG_DEBUG, "escaping removed %td bytes\n", (buf_end - *buf_ptr) - (dst - s->buffer)); @@ -1428,6 +1430,8 @@ int ff_mjpeg_find_marker(MJpegDecodeContext *s, *unescaped_buf_ptr = dst; *unescaped_buf_size = (bit_count + 7) >> 3; + memset(s->buffer + *unescaped_buf_size, 0, + FF_INPUT_BUFFER_PADDING_SIZE); } else { *unescaped_buf_ptr = *buf_ptr; *unescaped_buf_size = buf_end - *buf_ptr; From 91ac403b1316d59b4f43c4ea0f237e24cec2819a Mon Sep 17 00:00:00 2001 From: Mans Rullgard Date: Fri, 7 Dec 2012 13:53:56 +0000 Subject: [PATCH 2/2] lavf: fix arithmetic overflows in avformat_seek_file() The values compared here can be more than INT64_MAX apart. Since the difference is always positive, converting to uint64_t before subtracting gives the correct result without overflows. Signed-off-by: Mans Rullgard --- libavformat/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index 12b054d935..cd46caf3fd 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1762,7 +1762,7 @@ int avformat_seek_file(AVFormatContext *s, int stream_index, int64_t min_ts, int //Fallback to old API if new is not implemented but old is //Note the old has somewat different sematics if(s->iformat->read_seek || 1) - return av_seek_frame(s, stream_index, ts, flags | (ts - min_ts > (uint64_t)(max_ts - ts) ? AVSEEK_FLAG_BACKWARD : 0)); + return av_seek_frame(s, stream_index, ts, flags | ((uint64_t)ts - min_ts > (uint64_t)max_ts - ts ? AVSEEK_FLAG_BACKWARD : 0)); // try some generic seek like seek_frame_generic() but with new ts semantics }