[MPlayer-cvslog] CVS: main/libmpdemux demux_asf.c, 1.36, 1.37 demux_real.c, 1.76, 1.77 demux_viv.c, 1.28, 1.29 video.c, 1.55, 1.56
Jindrich Makovicka CVS
syncmail at mplayerhq.hu
Mon Dec 19 20:38:31 CET 2005
CVS change done by Jindrich Makovicka CVS
Update of /cvsroot/mplayer/main/libmpdemux
In directory mail:/var2/tmp/cvs-serv22236/libmpdemux
Modified Files:
demux_asf.c demux_real.c demux_viv.c video.c
Log Message:
malloc padding to avoid access beyond allocated memory
Credits to Mikulas Patocka (mikulas at artax karlin mff cuni cz)
Index: demux_asf.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_asf.c,v
retrieving revision 1.36
retrieving revision 1.37
diff -u -r1.36 -r1.37
--- demux_asf.c 18 Nov 2005 14:39:18 -0000 1.36
+++ demux_asf.c 19 Dec 2005 19:38:28 -0000 1.37
@@ -62,6 +62,11 @@
*src = dst;
}
+#ifdef USE_LIBAVCODEC
+#include "avcodec.h"
+#else
+#define FF_INPUT_BUFFER_PADDING_SIZE 8
+#endif
static int demux_asf_read_packet(demuxer_t *demux,unsigned char *data,int len,int id,int seq,unsigned long time,unsigned short dur,int offs,int keyframe){
demux_stream_t *ds=NULL;
@@ -106,8 +111,9 @@
// append data to it!
demux_packet_t* dp=ds->asf_packet;
if(dp->len!=offs && offs!=-1) mp_msg(MSGT_DEMUX,MSGL_V,"warning! fragment.len=%d BUT next fragment offset=%d \n",dp->len,offs);
- dp->buffer=realloc(dp->buffer,dp->len+len);
+ dp->buffer=realloc(dp->buffer,dp->len+len+FF_INPUT_BUFFER_PADDING_SIZE);
memcpy(dp->buffer+dp->len,data,len);
+ memset(dp->buffer+dp->len+len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
mp_dbg(MSGT_DEMUX,MSGL_DBG4,"data appended! %d+%d\n",dp->len,len);
dp->len+=len;
// we are ready now.
Index: demux_real.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_real.c,v
retrieving revision 1.76
retrieving revision 1.77
diff -u -r1.76 -r1.77
--- demux_real.c 11 Dec 2005 17:21:02 -0000 1.76
+++ demux_real.c 19 Dec 2005 19:38:28 -0000 1.77
@@ -32,6 +32,12 @@
#include "stheader.h"
#include "bswap.h"
+#ifdef USE_LIBAVCODEC
+#include "avcodec.h"
+#else
+#define FF_INPUT_BUFFER_PADDING_SIZE 8
+#endif
+
//#define mp_dbg(mod,lev, args... ) mp_msg_c((mod<<8)|lev, ## args )
#define MKTAG(a, b, c, d) (a | (b << 8) | (c << 16) | (d << 24))
@@ -921,7 +927,8 @@
// increase buffer size, this should not happen!
mp_msg(MSGT_DEMUX,MSGL_WARN, "chunktab buffer too small!!!!!\n");
dp->len=dp_hdr->chunktab+8*(4+dp_hdr->chunks);
- dp->buffer=realloc(dp->buffer,dp->len);
+ dp->buffer=realloc(dp->buffer,dp->len+FF_INPUT_BUFFER_PADDING_SIZE);
+ memset(dp->buffer + dp->len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
// re-calc pointers:
dp_hdr=(dp_hdr_t*)dp->buffer;
dp_data=dp->buffer+sizeof(dp_hdr_t);
Index: demux_viv.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/demux_viv.c,v
retrieving revision 1.28
retrieving revision 1.29
diff -u -r1.28 -r1.29
--- demux_viv.c 5 Aug 2005 19:57:47 -0000 1.28
+++ demux_viv.c 19 Dec 2005 19:38:28 -0000 1.29
@@ -15,6 +15,12 @@
#include "stheader.h"
#include "bswap.h"
+#ifdef USE_LIBAVCODEC
+#include "avcodec.h"
+#else
+#define FF_INPUT_BUFFER_PADDING_SIZE 8
+#endif
+
/* parameters ! */
int vivo_param_version = -1;
char *vivo_param_acodec = NULL;
@@ -379,7 +385,8 @@
} else {
// append data to it!
demux_packet_t* dp=ds->asf_packet;
- dp->buffer=realloc(dp->buffer,dp->len+len);
+ dp->buffer=realloc(dp->buffer,dp->len+len+FF_INPUT_BUFFER_PADDING_SIZE);
+ memset(dp->buffer+dp->len+len, 0, FF_INPUT_BUFFER_PADDING_SIZE);
//memcpy(dp->buffer+dp->len,data,len);
stream_read(demux->stream,dp->buffer+dp->len,len);
mp_dbg(MSGT_DEMUX,MSGL_DBG4,"data appended! %d+%d\n",dp->len,len);
Index: video.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpdemux/video.c,v
retrieving revision 1.55
retrieving revision 1.56
diff -u -r1.55 -r1.56
--- video.c 18 Nov 2005 14:39:21 -0000 1.55
+++ video.c 19 Dec 2005 19:38:28 -0000 1.56
@@ -22,6 +22,12 @@
/* sub_cc (closed captions)*/
#include "sub_cc.h"
+#ifdef USE_LIBAVCODEC
+#include "avcodec.h"
+#else
+#define FF_INPUT_BUFFER_PADDING_SIZE 8
+#endif
+
/* biCompression constant */
#define BI_RGB 0L
@@ -132,10 +138,13 @@
}
}
mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n");
- if(!videobuffer) videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE);
- if(!videobuffer){
- mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
- return 0;
+ if(!videobuffer) {
+ videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
+ if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+ else {
+ mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
+ return 0;
+ }
}
mp_msg(MSGT_DECVIDEO,MSGL_V,"Searching for Video Object Layer Start code... ");fflush(stdout);
while(1){
@@ -222,10 +231,13 @@
}
}
mp_msg(MSGT_DECVIDEO,MSGL_V,"OK!\n");
- if(!videobuffer) videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE);
- if(!videobuffer){
- mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
- return 0;
+ if(!videobuffer) {
+ videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
+ if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+ else {
+ mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
+ return 0;
+ }
}
pos = videobuf_len+4;
if(!read_video_packet(d_video)){
@@ -280,10 +292,13 @@
// sh_video=d_video->sh;sh_video->ds=d_video;
// mpeg2_init();
// ========= Read & process sequence header & extension ============
- if(!videobuffer) videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE);
- if(!videobuffer){
- mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
- return 0;
+ if(!videobuffer) {
+ videobuffer=(char*)memalign(8,VIDEOBUFFER_SIZE + FF_INPUT_BUFFER_PADDING_SIZE);
+ if (videobuffer) memset(videobuffer+VIDEOBUFFER_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE);
+ else {
+ mp_msg(MSGT_DECVIDEO,MSGL_ERR,MSGTR_ShMemAllocFail);
+ return 0;
+ }
}
if(!read_video_packet(d_video)){
More information about the MPlayer-cvslog
mailing list