History

Fix BugZilla Bug 1479668 heap-buffer-overflow when picture size changes in stream.

xiaotiansf committed 8 years ago

Commit 1535c0f1 parent 55c15431 file · +8 −0Browse files

Showing the changes to codec/decoder/core/src/decode_slice.cpp (1 of 1 file). Show all

Unified · Split

codec/decoder/core/src/decode_slice.cpp+8−0
@@ -52,6 +52,8 @@ · 51 unmodified lines
5252
5353 namespace WelsDec {
5454
55+extern void FreePicture (PPicture pPic, CMemoryAlign* pMa);
56+
5557 static inline int32_t iAbs (int32_t x) {
5658 static const int32_t INT_BITS = (sizeof (int) * CHAR_BIT) - 1;
5759 int32_t y = x >> INT_BITS;
@@ -208,6 +210,12 @@ int32_t WelsMbInterConstruction (PWelsDecoderContext pCtx, PDqLayer pCurLayer) { · 150 unmodified lines
208210 } else {
209211 if (pCtx->pTempDec == NULL)
210212 pCtx->pTempDec = AllocPicture (pCtx, pCtx->pSps->iMbWidth << 4, pCtx->pSps->iMbHeight << 4);
213+ else {
214+ if (pCtx->pTempDec->iLinesize[0] != pCtx->pDec->iLinesize[0]) {
215+ FreePicture (pCtx->pTempDec, pCtx->pMemAlign);
216+ pCtx->pTempDec = AllocPicture (pCtx, pCtx->pSps->iMbWidth << 4, pCtx->pSps->iMbHeight << 4);
217+ }
218+ }
211219 uint8_t* pTempDstYCbCr[3];
212220 uint8_t* pDstYCbCr[3];
213221 pTempDstYCbCr[0] = pCtx->pTempDec->pData[0] + ((iMbY * iLumaStride + iMbX) << 4);

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t