RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

swr: limit buffer size for discarding. 

This prevents insane memory usage in case of insane input values.
Untested due to lack of a testcase that causes such insane allocation

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-13 15:53:01 +01:00
parent e8bab4c6fc
commit b481d09bd9
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libswresample/swresample.c
View File

@ -707,22 +707,25 @@ int swr_convert(struct SwrContext *s, uint8_t *out_arg[SWR_CH_MAX], int out_coun
AudioData * in= &s->in; AudioData * in= &s->in;
AudioData *out= &s->out; AudioData *out= &s->out;
if(s->drop_output > 0){ while(s->drop_output > 0){
int ret; int ret;
uint8_t *tmp_arg[SWR_CH_MAX]; uint8_t *tmp_arg[SWR_CH_MAX];
if((ret=swri_realloc_audio(&s->drop_temp, s->drop_output))<0) #define MAX_DROP_STEP 16384
if((ret=swri_realloc_audio(&s->drop_temp, FFMIN(s->drop_output, MAX_DROP_STEP)))<0)
return ret; return ret;
reversefill_audiodata(&s->drop_temp, tmp_arg); reversefill_audiodata(&s->drop_temp, tmp_arg);
s->drop_output *= -1; //FIXME find a less hackish solution s->drop_output *= -1; //FIXME find a less hackish solution
ret = swr_convert(s, tmp_arg, -s->drop_output, in_arg, in_count); //FIXME optimize but this is as good as never called so maybe it doesnt matter ret = swr_convert(s, tmp_arg, FFMIN(-s->drop_output, MAX_DROP_STEP), in_arg, in_count); //FIXME optimize but this is as good as never called so maybe it doesnt matter
s->drop_output *= -1; s->drop_output *= -1;
if(ret>0) in_count = 0;
if(ret>0) {
s->drop_output -= ret; s->drop_output -= ret;
continue;
}
if(s->drop_output || !out_arg) if(s->drop_output || !out_arg)
return 0; return 0;
in_count = 0;
} }
if(!in_arg){ if(!in_arg){