Browse code

lagarith: reallocate rgb_planes when needed

Fixes invalid writes on pixel format changes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 4c3e1956ee35fdcc5ffdb28782050164b4623c0b)

Anton Khirnov authored on 2013/11/28 18:54:35
Showing 1 changed files
... ...
@@ -53,6 +53,7 @@ typedef struct LagarithContext {
53 53
     int zeros;                  /**< number of consecutive zero bytes encountered */
54 54
     int zeros_rem;              /**< number of zero bytes remaining to output */
55 55
     uint8_t *rgb_planes;
56
+    int      rgb_planes_allocated;
56 57
     int rgb_stride;
57 58
 } LagarithContext;
58 59
 
... ...
@@ -557,13 +558,12 @@ static int lag_decode_frame(AVCodecContext *avctx,
557 557
         offs[1] = offset_gu;
558 558
         offs[2] = offset_ry;
559 559
 
560
+        l->rgb_stride = FFALIGN(avctx->width, 16);
561
+        av_fast_malloc(&l->rgb_planes, &l->rgb_planes_allocated,
562
+                       l->rgb_stride * avctx->height * planes + 1);
560 563
         if (!l->rgb_planes) {
561
-            l->rgb_stride = FFALIGN(avctx->width, 16);
562
-            l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 1);
563
-            if (!l->rgb_planes) {
564
-                av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
565
-                return AVERROR(ENOMEM);
566
-            }
564
+            av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
565
+            return AVERROR(ENOMEM);
567 566
         }
568 567
         for (i = 0; i < planes; i++)
569 568
             srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;