RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/vp9_superframe_bsf: allocate cache of packets during init 

Also use av_packet_move_ref() to cache them instead of copying
pointers.

Fixes invalid reads since e1bc3f4396.

Signed-off-by: James Almer <jamrial@gmail.com>
This commit is contained in:
James Almer 2017-10-31 16:18:32 -03:00
parent 88c7aa13dd
commit 37f4a093f7
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/vp9_superframe_bsf.c
View File

@ -147,8 +147,8 @@ static int vp9_superframe_filter(AVBSFContext *ctx, AVPacket *out)
goto done;
}
s->cache[s->n_cache++] = in;
in = NULL;
av_packet_move_ref(s->cache[s->n_cache++], in);
if (invisible) {
res = AVERROR(EAGAIN);
goto done;
@ -164,7 +164,7 @@ static int vp9_superframe_filter(AVBSFContext *ctx, AVPacket *out)
goto done;
for (n = 0; n < s->n_cache; n++)
av_packet_free(&s->cache[n]);
av_packet_unref(s->cache[n]);
s->n_cache = 0;
done:
@ -174,13 +174,28 @@ done:
return res;
}
static int vp9_superframe_init(AVBSFContext *ctx)
{
VP9BSFContext *s = ctx->priv_data;
int n;
// alloc cached data
for (n = 0; n < MAX_CACHE; n++) {
s->cache[n] = av_packet_alloc();
if (!s->cache[n])
return AVERROR(ENOMEM);
}
return 0;
}
static void vp9_superframe_close(AVBSFContext *ctx)
{
VP9BSFContext *s = ctx->priv_data;
int n;
// free cached data
for (n = 0; n < s->n_cache; n++)
for (n = 0; n < MAX_CACHE; n++)
av_packet_free(&s->cache[n]);
}
@ -192,6 +207,7 @@ const AVBitStreamFilter ff_vp9_superframe_bsf = {
.name = "vp9_superframe",
.priv_data_size = sizeof(VP9BSFContext),
.filter = vp9_superframe_filter,
.init = vp9_superframe_init,
.close = vp9_superframe_close,
.codec_ids = codec_ids,
};