mirror of https://git.ffmpeg.org/ffmpeg.git
avcodec/pngdec: Fix padded alloc code with threads
Fixes Ticket2903 Fixes out of array write no releases should be affected by this Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
d814a839ac
commit
7b47d7f75e
|
@ -62,6 +62,7 @@ typedef struct PNGDecContext {
|
||||||
uint8_t *last_row;
|
uint8_t *last_row;
|
||||||
int last_row_size;
|
int last_row_size;
|
||||||
uint8_t *tmp_row;
|
uint8_t *tmp_row;
|
||||||
|
unsigned int tmp_row_size;
|
||||||
uint8_t *buffer;
|
uint8_t *buffer;
|
||||||
int buffer_size;
|
int buffer_size;
|
||||||
int pass;
|
int pass;
|
||||||
|
@ -331,6 +332,7 @@ static void png_handle_row(PNGDecContext *s)
|
||||||
png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
|
png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
|
||||||
s->last_row, s->pass_row_size, s->bpp);
|
s->last_row, s->pass_row_size, s->bpp);
|
||||||
FFSWAP(uint8_t*, s->last_row, s->tmp_row);
|
FFSWAP(uint8_t*, s->last_row, s->tmp_row);
|
||||||
|
FFSWAP(unsigned int, s->last_row_size, s->tmp_row_size);
|
||||||
got_line = 1;
|
got_line = 1;
|
||||||
}
|
}
|
||||||
if ((png_pass_dsp_ymask[s->pass] << (s->y & 7)) & 0x80) {
|
if ((png_pass_dsp_ymask[s->pass] << (s->y & 7)) & 0x80) {
|
||||||
|
@ -674,7 +676,7 @@ static int decode_frame(AVCodecContext *avctx,
|
||||||
goto fail;
|
goto fail;
|
||||||
if (s->interlace_type ||
|
if (s->interlace_type ||
|
||||||
s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
|
s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
|
||||||
s->tmp_row = av_malloc(s->row_size);
|
av_fast_padded_malloc(&s->tmp_row, &s->tmp_row_size, s->row_size);
|
||||||
if (!s->tmp_row)
|
if (!s->tmp_row)
|
||||||
goto fail;
|
goto fail;
|
||||||
}
|
}
|
||||||
|
@ -864,7 +866,6 @@ static int decode_frame(AVCodecContext *avctx,
|
||||||
the_end:
|
the_end:
|
||||||
inflateEnd(&s->zstream);
|
inflateEnd(&s->zstream);
|
||||||
s->crow_buf = NULL;
|
s->crow_buf = NULL;
|
||||||
av_freep(&s->tmp_row);
|
|
||||||
return ret;
|
return ret;
|
||||||
fail:
|
fail:
|
||||||
av_dict_free(&metadata);
|
av_dict_free(&metadata);
|
||||||
|
@ -918,6 +919,8 @@ static av_cold int png_dec_end(AVCodecContext *avctx)
|
||||||
s->buffer_size = 0;
|
s->buffer_size = 0;
|
||||||
av_freep(&s->last_row);
|
av_freep(&s->last_row);
|
||||||
s->last_row_size = 0;
|
s->last_row_size = 0;
|
||||||
|
av_freep(&s->tmp_row);
|
||||||
|
s->tmp_row_size = 0;
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue