1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
From 52b81ff4635c077b2bc8b8d3637d933b6629d803 Mon Sep 17 00:00:00 2001
From: Christophe Gisquet <christophe.gisquet@gmail.com>
Date: Mon, 11 Aug 2014 22:06:08 +0000
Subject: [PATCH] proresenc_kostya: report buffer overflow
If the allocated size, despite best efforts, is too small, exit
with the appropriate error.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavcodec/proresenc_kostya.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/libavcodec/proresenc_kostya.c b/libavcodec/proresenc_kostya.c
index 24cb333..a70ae3c 100644
--- a/libavcodec/proresenc_kostya.c
+++ b/libavcodec/proresenc_kostya.c
@@ -570,6 +570,11 @@ static int encode_slice(AVCodecContext *avctx, const AVFrame *pic,
quant);
}
total_size += sizes[i];
+ if (put_bits_left(pb) < 0) {
+ av_log(avctx, AV_LOG_ERROR, "Serious underevaluation of"
+ "required buffer size");
+ return AVERROR_BUFFER_TOO_SMALL;
+ }
}
return total_size;
}
@@ -940,9 +945,9 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I;
avctx->coded_frame->key_frame = 1;
- pkt_size = ctx->frame_size_upper_bound + FF_MIN_BUFFER_SIZE;
+ pkt_size = ctx->frame_size_upper_bound;
- if ((ret = ff_alloc_packet2(avctx, pkt, pkt_size)) < 0)
+ if ((ret = ff_alloc_packet2(avctx, pkt, pkt_size + FF_MIN_BUFFER_SIZE)) < 0)
return ret;
orig_buf = pkt->data;
@@ -1019,7 +1024,9 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt,
slice_hdr = buf;
buf += slice_hdr_size - 1;
init_put_bits(&pb, buf, (pkt_size - (buf - orig_buf)) * 8);
- encode_slice(avctx, pic, &pb, sizes, x, y, q, mbs_per_slice);
+ ret = encode_slice(avctx, pic, &pb, sizes, x, y, q, mbs_per_slice);
+ if (ret < 0)
+ return ret;
bytestream_put_byte(&slice_hdr, q);
slice_size = slice_hdr_size + sizes[ctx->num_planes - 1];
--
1.7.10.4
|
