Commit 4c3e1956 authored by Anton Khirnov's avatar Anton Khirnov

lagarith: reallocate rgb_planes when needed

Fixes invalid writes on pixel format changes.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
parent 2240e207
...@@ -52,6 +52,7 @@ typedef struct LagarithContext { ...@@ -52,6 +52,7 @@ typedef struct LagarithContext {
int zeros; /**< number of consecutive zero bytes encountered */ int zeros; /**< number of consecutive zero bytes encountered */
int zeros_rem; /**< number of zero bytes remaining to output */ int zeros_rem; /**< number of zero bytes remaining to output */
uint8_t *rgb_planes; uint8_t *rgb_planes;
int rgb_planes_allocated;
int rgb_stride; int rgb_stride;
} LagarithContext; } LagarithContext;
...@@ -564,13 +565,12 @@ static int lag_decode_frame(AVCodecContext *avctx, ...@@ -564,13 +565,12 @@ static int lag_decode_frame(AVCodecContext *avctx,
offs[1] = offset_gu; offs[1] = offset_gu;
offs[2] = offset_ry; offs[2] = offset_ry;
l->rgb_stride = FFALIGN(avctx->width, 16);
av_fast_malloc(&l->rgb_planes, &l->rgb_planes_allocated,
l->rgb_stride * avctx->height * planes + 1);
if (!l->rgb_planes) { if (!l->rgb_planes) {
l->rgb_stride = FFALIGN(avctx->width, 16); av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
l->rgb_planes = av_malloc(l->rgb_stride * avctx->height * planes + 1); return AVERROR(ENOMEM);
if (!l->rgb_planes) {
av_log(avctx, AV_LOG_ERROR, "cannot allocate temporary buffer\n");
return AVERROR(ENOMEM);
}
} }
for (i = 0; i < planes; i++) for (i = 0; i < planes; i++)
srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride; srcs[i] = l->rgb_planes + (i + 1) * l->rgb_stride * avctx->height - l->rgb_stride;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment