From: Michael Niedermayer Date: Wed, 14 Aug 2013 08:35:38 +0000 (+0200) Subject: Merge commit '075dbc185521f193c98b896cd63be3ec2613df5d' X-Git-Tag: android-x86-4.4-r1~1780 X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=86fe16a763abf2d44a9d3c2ed6d19324239731e4;p=android-x86%2Fexternal-ffmpeg.git Merge commit '075dbc185521f193c98b896cd63be3ec2613df5d' * commit '075dbc185521f193c98b896cd63be3ec2613df5d': nuv: Pad the lzo outbuf Conflicts: libavcodec/nuv.c See: 95e1dfee76c9ecdf70037b7e792897bc6e3d460b See: 266f6eefc603dd3c34be7de94eec5c9c293b80f1 Merged-by: Michael Niedermayer --- 86fe16a763abf2d44a9d3c2ed6d19324239731e4 diff --cc libavcodec/nuv.c index 3888c0c550,0905411449..edb38c303e --- a/libavcodec/nuv.c +++ b/libavcodec/nuv.c @@@ -121,10 -120,6 +121,10 @@@ static int codec_reinit(AVCodecContext if (quality >= 0) get_quant_quality(c, quality); if (width != c->width || height != c->height) { + // also reserve space for a possible additional header - int buf_size = 24 + height * width * 3 / 2 + AV_LZO_OUTPUT_PADDING; ++ int buf_size = 24 + height * width * 3 / 2 + FFMAX(AV_LZO_OUTPUT_PADDING, FF_INPUT_BUFFER_PADDING_SIZE); + if (buf_size > INT_MAX/8) + return -1; if ((ret = av_image_check_size(height, width, 0, avctx)) < 0) return ret; avctx->width = c->width = width; @@@ -207,13 -200,14 +207,14 @@@ retry buf = &buf[12]; buf_size -= 12; if (comptype == NUV_RTJPEG_IN_LZO || comptype == NUV_LZO) { - int outlen = c->decomp_size - AV_LZO_OUTPUT_PADDING, inlen = buf_size; - int outlen = c->decomp_size - FF_INPUT_BUFFER_PADDING_SIZE; ++ int outlen = c->decomp_size - FFMAX(FF_INPUT_BUFFER_PADDING_SIZE, AV_LZO_OUTPUT_PADDING); + int inlen = buf_size; if (av_lzo1x_decode(c->decomp_buf, &outlen, buf, &inlen)) { av_log(avctx, AV_LOG_ERROR, "error during lzo decompression\n"); return AVERROR_INVALIDDATA; } buf = c->decomp_buf; - buf_size = c->decomp_size - AV_LZO_OUTPUT_PADDING - outlen; - buf_size = outlen; ++ buf_size = c->decomp_size - FFMAX(FF_INPUT_BUFFER_PADDING_SIZE, AV_LZO_OUTPUT_PADDING) - outlen; } if (c->codec_frameheader) { int w, h, q;