[FFmpeg-cvslog] swr: limit buffer size for discarding.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Jan 13 15:53:01 2013 +0100| [b481d09bd9c7b3cba617a7811d7015ea0472e4ee] | committer: Michael Niedermayer

swr: limit buffer size for discarding.

This prevents insane memory usage in case of insane input values.
Untested due to lack of a testcase that causes such insane allocation

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b481d09bd9c7b3cba617a7811d7015ea0472e4ee
---

 libswresample/swresample.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/libswresample/swresample.c b/libswresample/swresample.c
index 4576d2f..6f1c41b 100644
--- a/libswresample/swresample.c
+++ b/libswresample/swresample.c
@@ -707,22 +707,25 @@ int swr_convert(struct SwrContext *s, uint8_t *out_arg[SWR_CH_MAX], int out_coun
     AudioData * in= &s->in;
     AudioData *out= &s->out;
 
-    if(s->drop_output > 0){
+    while(s->drop_output > 0){
         int ret;
         uint8_t *tmp_arg[SWR_CH_MAX];
-        if((ret=swri_realloc_audio(&s->drop_temp, s->drop_output))<0)
+#define MAX_DROP_STEP 16384
+        if((ret=swri_realloc_audio(&s->drop_temp, FFMIN(s->drop_output, MAX_DROP_STEP)))<0)
             return ret;
 
         reversefill_audiodata(&s->drop_temp, tmp_arg);
         s->drop_output *= -1; //FIXME find a less hackish solution
-        ret = swr_convert(s, tmp_arg, -s->drop_output, in_arg, in_count); //FIXME optimize but this is as good as never called so maybe it doesnt matter
+        ret = swr_convert(s, tmp_arg, FFMIN(-s->drop_output, MAX_DROP_STEP), in_arg, in_count); //FIXME optimize but this is as good as never called so maybe it doesnt matter
         s->drop_output *= -1;
-        if(ret>0)
+        in_count = 0;
+        if(ret>0) {
             s->drop_output -= ret;
+            continue;
+        }
 
         if(s->drop_output || !out_arg)
             return 0;
-        in_count = 0;
     }
 
     if(!in_arg){