[FFmpeg-devel] [PATCH] cllc: Pad swapepd buffer

[Reimar Döffinger]

On 25 Aug 2012, at 04:17, Derek Buitenhuis <derek.buitenhuis at gmail.com> wrote:
> The bitstream buffer must be padded, or the bitstream reader might
> read over the end.
> 
> Fixes the following valgrind warning:
>    Use of uninitialised value of size 8 at 0x591BAE: cllc_decode_frame (cllc.c:166)
> 
> Signed-off-by: Derek Buitenhuis <derek.buitenhuis at gmail.com>
> ---
> libavcodec/cllc.c |    7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/libavcodec/cllc.c b/libavcodec/cllc.c
> index af51c36..7625852 100644
> --- a/libavcodec/cllc.c
> +++ b/libavcodec/cllc.c
> @@ -284,7 +284,8 @@ static int cllc_decode_frame(AVCodecContext *avctx, void *data,
> 
>     /* Make sure our bswap16'd buffer is big enough */
>     swapped_buf_new = av_fast_realloc(ctx->swapped_buf,
> -                                      &ctx->swapped_buf_size, avpkt->size);
> +                                      &ctx->swapped_buf_size, avpkt->size +
> +                                      FF_INPUT_BUFFER_PADDING_SIZE);

Sorry for asking without looking at the code, but does this have to be realloc?
Because we have av_fast_padded_malloc (or such) that includes this, without a (in thus case only on invalid input I think) risk for integer overflow, and initializes the padding to 0.