Fix BugZilla Bug 1479668 heap-buffer-overflow when picture size changes in stream.

xiaotiansf committed 8 years ago

Commit 1535c0f1 parent 55c15431 file · +8 −0Browse files

Showing the changes to codec/decoder/core/src/decode_slice.cpp (1 of 1 file). Show all

Unified · Split

 namespace WelsDec {
+extern void FreePicture (PPicture pPic, CMemoryAlign* pMa);
 static inline int32_t iAbs (int32_t x) {
   static const int32_t INT_BITS = (sizeof (int) * CHAR_BIT) - 1;
   int32_t y = x >> INT_BITS;
   } else {
     if (pCtx->pTempDec == NULL)
       pCtx->pTempDec = AllocPicture (pCtx, pCtx->pSps->iMbWidth << 4, pCtx->pSps->iMbHeight << 4);
+    else {
+      if (pCtx->pTempDec->iLinesize[0] != pCtx->pDec->iLinesize[0]) {
+        FreePicture (pCtx->pTempDec, pCtx->pMemAlign);
+        pCtx->pTempDec = AllocPicture (pCtx, pCtx->pSps->iMbWidth << 4, pCtx->pSps->iMbHeight << 4);
+      }
+    }
     uint8_t*   pTempDstYCbCr[3];
     uint8_t*   pDstYCbCr[3];
     pTempDstYCbCr[0] = pCtx->pTempDec->pData[0] + ((iMbY * iLumaStride + iMbX) << 4);

Keyboard shortcuts