[FFmpeg-cvslog] avformat/flac_picture: allocate buffer padding for picture

[Michael Niedermayer]

ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Fri Jan 31 17:21:32 2014 +0100| [c9b961748f79f875360d5519963d08f7972bb935] | committer: Michael Niedermayer

avformat/flac_picture: allocate buffer padding for picture

Fixes: heap array overread
Fixes: asan_heap-oob_14876d9_4706_cov_815472558_cover_art.flac
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit fff2953163ff466d5391b2f862bd2216fbe728b2)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=c9b961748f79f875360d5519963d08f7972bb935
---

 libavformat/flac_picture.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/flac_picture.c b/libavformat/flac_picture.c
index 12d73e4..a58b305 100644
--- a/libavformat/flac_picture.c
+++ b/libavformat/flac_picture.c
@@ -107,7 +107,7 @@ int ff_flac_parse_picture(AVFormatContext *s, uint8_t *buf, int buf_size)
             ret = AVERROR_INVALIDDATA;
         goto fail;
     }
-    if (!(data = av_buffer_alloc(len))) {
+    if (!(data = av_buffer_alloc(len + FF_INPUT_BUFFER_PADDING_SIZE))) {
         RETURN_ERROR(AVERROR(ENOMEM));
     }
     if (avio_read(pb, data->data, len) != len) {