[FFmpeg-cvslog] avfilter/vf_fieldmatch: fix heap-buffer overflow

[Paul B Mahol]

ffmpeg | branch: release/4.1 | Paul B Mahol <onemda at gmail.com> | Sat Oct 19 11:56:02 2019 +0200| [d60effdf83eddcdb18c84d339a526fb0318723fe] | committer: James Almer

avfilter/vf_fieldmatch: fix heap-buffer overflow

Also fix use of uninitialized values.

Fixes #8239

(cherry picked from commit ce5274c1385d55892a692998923802023526b765)
Signed-off-by: James Almer <jamrial at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=d60effdf83eddcdb18c84d339a526fb0318723fe
---

 libavfilter/vf_fieldmatch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_fieldmatch.c b/libavfilter/vf_fieldmatch.c
index 5a73eb43b8..8d1e68b85f 100644
--- a/libavfilter/vf_fieldmatch.c
+++ b/libavfilter/vf_fieldmatch.c
@@ -938,7 +938,7 @@ static int config_input(AVFilterLink *inlink)
     fm->tpitchy  = FFALIGN(w,      16);
     fm->tpitchuv = FFALIGN(w >> 1, 16);
 
-    fm->tbuffer = av_malloc(h/2 * fm->tpitchy);
+    fm->tbuffer = av_calloc((h/2 + 4) * fm->tpitchy, sizeof(*fm->tbuffer));
     fm->c_array = av_malloc((((w + fm->blockx/2)/fm->blockx)+1) *
                             (((h + fm->blocky/2)/fm->blocky)+1) *
                             4 * sizeof(*fm->c_array));