diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-18 14:20:07 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-18 22:18:01 +0100 |
| commit | 6f37226b687f969bcf6e47a4fb5c28a32d107aa3 (patch) | |
| tree | 024de02fcf35c7b78ffc62c3185e12c5574a4d1d | |
| parent | fc91eeab0b3c59f431653dec4e7358630b2c1f7e (diff) | |
| download | ffmpeg-6f37226b687f969bcf6e47a4fb5c28a32d107aa3.tar.gz | |
avcodec/h264_slice: Clear top_borders on allocation
In case of bitstream errors the deblock filter and slices can access uninitialized
top_borders from previous slices which did not fill them as they stoped halfway due
to error or where entirely missing.
This also makes code using these tables deterministic in case of missing or damaged
slices
Found-by: Tyson Smith
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/h264_slice.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/h264_slice.c b/libavcodec/h264_slice.c index eceda8a9bc..2eaffa580c 100644 --- a/libavcodec/h264_slice.c +++ b/libavcodec/h264_slice.c @@ -171,9 +171,9 @@ static int alloc_scratch_buffers(H264SliceContext *sl, int linesize) // (= 21x21 for h264) av_fast_malloc(&sl->edge_emu_buffer, &sl->edge_emu_buffer_allocated, alloc_size * 2 * 21); - av_fast_malloc(&sl->top_borders[0], &sl->top_borders_allocated[0], + av_fast_mallocz(&sl->top_borders[0], &sl->top_borders_allocated[0], h->mb_width * 16 * 3 * sizeof(uint8_t) * 2); - av_fast_malloc(&sl->top_borders[1], &sl->top_borders_allocated[1], + av_fast_mallocz(&sl->top_borders[1], &sl->top_borders_allocated[1], h->mb_width * 16 * 3 * sizeof(uint8_t) * 2); if (!sl->bipred_scratchpad || !sl->edge_emu_buffer || |