avfilter/vf_fieldmatch: fix heap-buffer overflow
authorPaul B Mahol <onemda@gmail.com>
Sat, 19 Oct 2019 09:56:02 +0000 (11:56 +0200)
committerPaul B Mahol <onemda@gmail.com>
Sat, 19 Oct 2019 09:58:34 +0000 (11:58 +0200)
Also fix use of uninitialized values.

Fixes #8239

libavfilter/vf_fieldmatch.c

index d115229..fa4aa82 100644 (file)
@@ -950,7 +950,7 @@ static int config_input(AVFilterLink *inlink)
     fm->tpitchy  = FFALIGN(w,      16);
     fm->tpitchuv = FFALIGN(w >> 1, 16);
 
-    fm->tbuffer = av_malloc(h/2 * fm->tpitchy);
+    fm->tbuffer = av_calloc((h/2 + 4) * fm->tpitchy, sizeof(*fm->tbuffer));
     fm->c_array = av_malloc((((w + fm->blockx/2)/fm->blockx)+1) *
                             (((h + fm->blocky/2)/fm->blocky)+1) *
                             4 * sizeof(*fm->c_array));