From e8b060f7e72f76e7d9e62ad4733201770cbe2bb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= <Reimar.Doeffinger@gmx.de>
Date: Wed, 18 Jan 2012 21:23:22 +0100
Subject: [PATCH] Use av_fast_padded_malloc in mimic and truemotion2 decoders.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes use of uninitialized data errors under valgrind.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
---
 libavcodec/mimic.c       |  3 +--
 libavcodec/truemotion2.c | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/libavcodec/mimic.c b/libavcodec/mimic.c
index 1cac84fc66..652dd1bb5d 100644
--- a/libavcodec/mimic.c
+++ b/libavcodec/mimic.c
@@ -367,8 +367,7 @@ static int mimic_decode_frame(AVCodecContext *avctx, void *data,
 
     ff_thread_finish_setup(avctx);
 
-    av_fast_malloc(&ctx->swap_buf, &ctx->swap_buf_size,
-                                 swap_buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
+    av_fast_padded_malloc(&ctx->swap_buf, &ctx->swap_buf_size, swap_buf_size);
     if(!ctx->swap_buf)
         return AVERROR(ENOMEM);
 
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c
index 567383499a..e68a68757f 100644
--- a/libavcodec/truemotion2.c
+++ b/libavcodec/truemotion2.c
@@ -44,6 +44,9 @@ typedef struct TM2Context{
     GetBitContext gb;
     DSPContext dsp;
 
+    uint8_t *buffer;
+    int buffer_size;
+
     /* TM2 streams */
     int *tokens[TM2_NUM_STREAMS];
     int tok_lens[TM2_NUM_STREAMS];
@@ -766,10 +769,9 @@ static int decode_frame(AVCodecContext *avctx,
     TM2Context * const l = avctx->priv_data;
     AVFrame * const p= (AVFrame*)&l->pic;
     int i, skip, t;
-    uint8_t *swbuf;
 
-    swbuf = av_malloc(buf_size + FF_INPUT_BUFFER_PADDING_SIZE);
-    if(!swbuf){
+    av_fast_padded_malloc(&l->buffer, &l->buffer_size, buf_size);
+    if(!l->buffer){
         av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer\n");
         return -1;
     }
@@ -777,22 +779,19 @@ static int decode_frame(AVCodecContext *avctx,
     p->buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE;
     if(avctx->reget_buffer(avctx, p) < 0){
         av_log(avctx, AV_LOG_ERROR, "get_buffer() failed\n");
-        av_free(swbuf);
         return -1;
     }
 
-    l->dsp.bswap_buf((uint32_t*)swbuf, (const uint32_t*)buf, buf_size >> 2);
-    skip = tm2_read_header(l, swbuf);
+    l->dsp.bswap_buf((uint32_t*)l->buffer, (const uint32_t*)buf, buf_size >> 2);
+    skip = tm2_read_header(l, l->buffer);
 
     if(skip == -1){
-        av_free(swbuf);
         return -1;
     }
 
     for(i = 0; i < TM2_NUM_STREAMS; i++){
-        t = tm2_read_stream(l, swbuf + skip, tm2_stream_order[i], buf_size);
+        t = tm2_read_stream(l, l->buffer + skip, tm2_stream_order[i], buf_size);
         if(t == -1){
-            av_free(swbuf);
             return -1;
         }
         skip += t;
@@ -806,7 +805,6 @@ static int decode_frame(AVCodecContext *avctx,
     l->cur = !l->cur;
     *data_size = sizeof(AVFrame);
     *(AVFrame*)data = l->pic;
-    av_free(swbuf);
 
     return buf_size;
 }
@@ -863,6 +861,8 @@ static av_cold int decode_end(AVCodecContext *avctx){
         av_free(l->U2);
         av_free(l->V2);
     }
+    av_freep(&l->buffer);
+    l->buffer_size = 0;
 
     if (pic->data[0])
         avctx->release_buffer(avctx, pic);