RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

wmall: use AVFrame API properly 

This fixes a bug with non-refcounted callers resulting in invalid memory access.

Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Hendrik Leppkes 2013-08-08 18:48:43 +02:00 committed by Anton Khirnov
parent 5718e3487b
commit 3ca5df36a5
1 changed files with 25 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
libavcodec/wmalosslessdec.c
View File

@ -66,7 +66,7 @@ typedef struct {
typedef struct WmallDecodeCtx { typedef struct WmallDecodeCtx {
/* generic decoder variables */ /* generic decoder variables */
AVCodecContext *avctx; AVCodecContext *avctx;
AVFrame frame; AVFrame *frame;
uint8_t frame_data[MAX_FRAMESIZE + FF_INPUT_BUFFER_PADDING_SIZE]; ///< compressed frame data uint8_t frame_data[MAX_FRAMESIZE + FF_INPUT_BUFFER_PADDING_SIZE]; ///< compressed frame data
PutBitContext pb; ///< context for filling the frame_data buffer PutBitContext pb; ///< context for filling the frame_data buffer
@ -261,8 +261,10 @@ static av_cold int decode_init(AVCodecContext *avctx)
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
avcodec_get_frame_defaults(&s->frame); s->frame = av_frame_alloc();
avctx->coded_frame = &s->frame; if (!s->frame)
return AVERROR(ENOMEM);
avctx->channel_layout = channel_mask; avctx->channel_layout = channel_mask;
return 0; return 0;
} }
@ -908,7 +910,7 @@ static int decode_subframe(WmallDecodeCtx *s)
} else if (!s->cdlms[0][0].order) { } else if (!s->cdlms[0][0].order) {
av_log(s->avctx, AV_LOG_DEBUG, av_log(s->avctx, AV_LOG_DEBUG,
"Waiting for seekable tile\n"); "Waiting for seekable tile\n");
s->frame.nb_samples = 0; av_frame_unref(s->frame);
return -1; return -1;
} }
@ -1015,8 +1017,8 @@ static int decode_frame(WmallDecodeCtx *s)
GetBitContext* gb = &s->gb; GetBitContext* gb = &s->gb;
int more_frames = 0, len = 0, i, ret; int more_frames = 0, len = 0, i, ret;
s->frame.nb_samples = s->samples_per_frame; s->frame->nb_samples = s->samples_per_frame;
if ((ret = ff_get_buffer(s->avctx, &s->frame, 0)) < 0) { if ((ret = ff_get_buffer(s->avctx, s->frame, 0)) < 0) {
/* return an error if no frame could be decoded at all */ /* return an error if no frame could be decoded at all */
av_log(s->avctx, AV_LOG_ERROR, av_log(s->avctx, AV_LOG_ERROR,
"not enough space for the output samples\n"); "not enough space for the output samples\n");
@ -1024,8 +1026,8 @@ static int decode_frame(WmallDecodeCtx *s)
return ret; return ret;
} }
for (i = 0; i < s->num_channels; i++) { for (i = 0; i < s->num_channels; i++) {
s->samples_16[i] = (int16_t *)s->frame.extended_data[i]; s->samples_16[i] = (int16_t *)s->frame->extended_data[i];
s->samples_32[i] = (int32_t *)s->frame.extended_data[i]; s->samples_32[i] = (int32_t *)s->frame->extended_data[i];
} }
/* get frame length */ /* get frame length */
@ -1172,7 +1174,7 @@ static int decode_packet(AVCodecContext *avctx, void *data, int *got_frame_ptr,
int buf_size = avpkt->size; int buf_size = avpkt->size;
int num_bits_prev_frame, packet_sequence_number, spliced_packet; int num_bits_prev_frame, packet_sequence_number, spliced_packet;
s->frame.nb_samples = 0; s->frame->nb_samples = 0;
if (s->packet_done || s->packet_loss) { if (s->packet_done || s->packet_loss) {
s->packet_done = 0; s->packet_done = 0;
@ -1265,8 +1267,9 @@ static int decode_packet(AVCodecContext *avctx, void *data, int *got_frame_ptr,
save_bits(s, gb, remaining_bits(s, gb), 0); save_bits(s, gb, remaining_bits(s, gb), 0);
} }
*(AVFrame *)data = s->frame; *got_frame_ptr = s->frame->nb_samples > 0;
*got_frame_ptr = s->frame.nb_samples > 0; av_frame_move_ref(data, s->frame);
s->packet_offset = get_bits_count(gb) & 7; s->packet_offset = get_bits_count(gb) & 7;
return (s->packet_loss) ? AVERROR_INVALIDDATA : get_bits_count(gb) >> 3; return (s->packet_loss) ? AVERROR_INVALIDDATA : get_bits_count(gb) >> 3;
@ -1281,16 +1284,26 @@ static void flush(AVCodecContext *avctx)
s->frame_offset = 0; s->frame_offset = 0;
s->next_packet_start = 0; s->next_packet_start = 0;
s->cdlms[0][0].order = 0; s->cdlms[0][0].order = 0;
s->frame.nb_samples = 0; s->frame->nb_samples = 0;
init_put_bits(&s->pb, s->frame_data, MAX_FRAMESIZE); init_put_bits(&s->pb, s->frame_data, MAX_FRAMESIZE);
} }
static av_cold int decode_close(AVCodecContext *avctx)
{
WmallDecodeCtx *s = avctx->priv_data;
av_frame_free(&s->frame);
return 0;
}
AVCodec ff_wmalossless_decoder = { AVCodec ff_wmalossless_decoder = {
.name = "wmalossless", .name = "wmalossless",
.type = AVMEDIA_TYPE_AUDIO, .type = AVMEDIA_TYPE_AUDIO,
.id = AV_CODEC_ID_WMALOSSLESS, .id = AV_CODEC_ID_WMALOSSLESS,
.priv_data_size = sizeof(WmallDecodeCtx), .priv_data_size = sizeof(WmallDecodeCtx),
.init = decode_init, .init = decode_init,
.close = decode_close,
.decode = decode_packet, .decode = decode_packet,
.flush = flush, .flush = flush,
.capabilities = CODEC_CAP_SUBFRAMES | CODEC_CAP_DR1 | CODEC_CAP_DELAY, .capabilities = CODEC_CAP_SUBFRAMES | CODEC_CAP_DR1 | CODEC_CAP_DELAY,