Browse code

avcodec/pngenc: Replace memcpy by av_image_copy()

Fixes out of array access
Fixes: 0cf176e6d3ab9fe924f39738e513f547/asan_generic_4a54aa_3431_aaa28be1cb32e307a9890cad06f84fba.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7ec9c5ce8a753175244da971fed9f1e25aef7971)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Michael Niedermayer authored on 2016/01/15 08:35:57
Showing 1 changed files
... ...
@@ -747,8 +747,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict,
747 747
 
748 748
             // Do disposal
749 749
             if (last_fctl_chunk.dispose_op != APNG_DISPOSE_OP_PREVIOUS) {
750
-                memcpy(diffFrame->data[0], s->last_frame->data[0],
751
-                       s->last_frame->linesize[0] * s->last_frame->height);
750
+                av_frame_copy(diffFrame, s->last_frame);
752 751
 
753 752
                 if (last_fctl_chunk.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
754 753
                     for (y = last_fctl_chunk.y_offset; y < last_fctl_chunk.y_offset + last_fctl_chunk.height; ++y) {
... ...
@@ -760,8 +759,7 @@ static int apng_encode_frame(AVCodecContext *avctx, const AVFrame *pict,
760 760
                 if (!s->prev_frame)
761 761
                     continue;
762 762
 
763
-                memcpy(diffFrame->data[0], s->prev_frame->data[0],
764
-                       s->prev_frame->linesize[0] * s->prev_frame->height);
763
+                av_frame_copy(diffFrame, s->prev_frame);
765 764
             }
766 765
 
767 766
             // Do inverse blending
... ...
@@ -923,8 +921,7 @@ static int encode_apng(AVCodecContext *avctx, AVPacket *pkt,
923 923
             }
924 924
 
925 925
             // Do disposal, but not blending
926
-            memcpy(s->prev_frame->data[0], s->last_frame->data[0],
927
-                   s->last_frame->linesize[0] * s->last_frame->height);
926
+            av_frame_copy(s->prev_frame, s->last_frame);
928 927
             if (s->last_frame_fctl.dispose_op == APNG_DISPOSE_OP_BACKGROUND) {
929 928
                 uint32_t y;
930 929
                 uint8_t bpp = (s->bits_per_pixel + 7) >> 3;