Fixes invalid writes on pixel format changes.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 4c3e1956ee35fdcc5ffdb28782050164b4623c0b)
... | ... |
@@ -53,6 +53,7 @@ typedef struct LagarithContext { |
53 | 53 |
int zeros; /**< number of consecutive zero bytes encountered */ |
54 | 54 |
int zeros_rem; /**< number of zero bytes remaining to output */ |
55 | 55 |
uint8_t *rgb_planes; |
56 |
+ int rgb_planes_allocated; |
|
56 | 57 |
int rgb_stride; |
57 | 58 |
} LagarithContext; |
58 | 59 |
|
... | ... |
@@ -557,13 +558,12 @@ static int lag_decode_frame(AVCodecContext *avctx, |
557 | 557 |
offs[1] = offset_gu; |
558 | 558 |
offs[2] = offset_ry; |
559 | 559 |
|
560 |
+ l->rgb_stride = FFALIGN(avctx->width, 16); |
|
561 |
+ av_fast_malloc(&l->rgb_planes, &l->rgb_planes_allocated, |
|
562 |
+ l->rgb_stride * avctx->height * planes + 1); |
|
560 | 563 |
if (!l->rgb_planes) { |
561 |
- l->rgb_stride = FFALIGN(avctx->width, 16); |
|
562 |
- l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 1); |
|
563 |
- if (!l->rgb_planes) { |
|
564 |
- av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n"); |
|
565 |
- return AVERROR(ENOMEM); |
|
566 |
- } |
|
564 |
+ av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n"); |
|
565 |
+ return AVERROR(ENOMEM); |
|
567 | 566 |
} |
568 | 567 |
for (i = 0; i < planes; i++) |
569 | 568 |
srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride; |