[Redbutton-devel] SF.net SVN: redbutton: [321] redbutton-browser/trunk/MHEGDisplay.c

[<ski...@us...>]

Revision: 321
          http://redbutton.svn.sourceforge.net/redbutton/?rev=321&view=rev
Author:   skilvington
Date:     2007-08-10 09:26:50 -0700 (Fri, 10 Aug 2007)

Log Message:
-----------
make sure ffmpeg doesn't read passed the end of our buffer

Modified Paths:
--------------
    redbutton-browser/trunk/MHEGDisplay.c

Modified: redbutton-browser/trunk/MHEGDisplay.c
===================================================================
--- redbutton-browser/trunk/MHEGDisplay.c	2007-07-16 16:00:42 UTC (rev 320)
+++ redbutton-browser/trunk/MHEGDisplay.c	2007-08-10 16:26:50 UTC (rev 321)
@@ -852,6 +852,7 @@
 	AVCodec *codec;
 	AVFrame *yuv_frame;
 	AVFrame *rgb_frame;
+	unsigned char *padded;
 	unsigned char *data;
 	unsigned int size;
 	int used;
@@ -880,8 +881,13 @@
 	if((rgb_frame = avcodec_alloc_frame()) == NULL)
 		fatal("Out of memory");
 
+	/* ffmpeg may read passed the end of the buffer, so pad it out */
+	padded = safe_malloc(mpeg->size + FF_INPUT_BUFFER_PADDING_SIZE);
+	memcpy(padded, mpeg->data, mpeg->size);
+	memset(padded + mpeg->size, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+
 	/* decode the YUV frame */
-	data = mpeg->data;
+	data = padded;
 	size = mpeg->size;
 	do
 	{
@@ -914,6 +920,7 @@
 	}
 
 	/* clean up */
+	safe_free(padded);
 	safe_free(rgba);
 	av_free(yuv_frame);
 	av_free(rgb_frame);


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.