generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/ffv1: seperate slice_count from max_slice_count

Browse Source 
Fix segfault with too large slice_count
Fixes Ticket4879

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit aa6c43f3fd)

Conflicts:
	libavcodec/ffv1enc.c
	libavcodec/ffv1.c
This commit is contained in:
Michael Niedermayer
2015-09-24 23:49:30 +02:00
committed by Carl Eugen Hoyos
parent b0b37e018b
commit ef6d6f8906
4 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/ffv1enc.c
View File

@@ -962,6 +962,7 @@ slices_ok:
if ((ret = ffv1_init_slice_contexts(s)) < 0)
return ret;
s->slice_count = s->max_slice_count;
if ((ret = ffv1_init_slices_state(s)) < 0)
return ret;
@@ -971,7 +972,7 @@ slices_ok:
if (!avctx->stats_out)
return AVERROR(ENOMEM);
for (i = 0; i < s->quant_table_count; i++)
for (j = 0; j < s->slice_count; j++) {
for (j = 0; j < s->max_slice_count; j++) {
FFV1Context *sf = s->slice_context[j];
av_assert0(!sf->rc_stat2[i]);
sf->rc_stat2[i] = av_mallocz(s->context_count[i] *
@@ -1195,6 +1196,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
for (i = 0; i < f->quant_table_count; i++)
memset(f->rc_stat2[i], 0, f->context_count[i] * sizeof(*f->rc_stat2[i]));
av_assert0(f->slice_count == f->max_slice_count);
for (j = 0; j < f->slice_count; j++) {
FFV1Context *fs = f->slice_context[j];
for (i = 0; i < 256; i++) {