avcodec/a64multienc: don't set incorrect packet size

This fixes invalid reads of the packet buffer in av_dup_packet

Based on patch by Andreas Cadhalpun <andreas.cadhalpun@googlemail.com>

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d96142e9af)

Conflicts:

	libavcodec/a64multienc.c
This commit is contained in:
Michael Niedermayer 2015-02-23 01:21:30 +01:00
parent d0da72ebb0
commit 91ced1608c
1 changed files with 3 additions and 2 deletions

View File

@ -336,8 +336,8 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
req_size = 0;
/* any frames to encode? */
if (c->mc_lifetime) {
req_size = charset_size + c->mc_lifetime*(screen_size + colram_size);
if ((ret = ff_alloc_packet2(avctx, pkt, req_size)) < 0)
int alloc_size = charset_size + c->mc_lifetime*(screen_size + colram_size);
if ((ret = ff_alloc_packet2(avctx, pkt, alloc_size)) < 0)
return ret;
buf = pkt->data;
@ -354,6 +354,7 @@ static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
/* advance pointers */
buf += charset_size;
charset += charset_size;
req_size += charset_size;
}
/* write x frames to buf */