vcodec/h2645_parse: Clear buffer padding
authorMichael Niedermayer <michael@niedermayer.cc>
Thu, 18 Aug 2016 20:23:32 +0000 (22:23 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Thu, 18 Aug 2016 21:36:18 +0000 (23:36 +0200)
Fixes use of uninitialized memory
Fixes: 044100cb22845944988a4bd821ff8074/asan_heap-oob_329927a_1366_c3de34ce9217dac820fbb46171031bbb.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/h2645_parse.c

index 4ed4c9a..e92e38a 100644 (file)
@@ -34,7 +34,7 @@ int ff_h2645_extract_rbsp(const uint8_t *src, int length,
 {
     int i, si, di;
     uint8_t *dst;
-    int64_t padding = small_padding ? AV_INPUT_BUFFER_PADDING_SIZE : MAX_MBPAIR_SIZE;
+    int64_t padding = small_padding ? 0 : MAX_MBPAIR_SIZE;
 
     nal->skipped_bytes = 0;
 #define STARTCODE_TEST                                                  \
@@ -90,8 +90,8 @@ int ff_h2645_extract_rbsp(const uint8_t *src, int length,
         return length;
     }
 
-    av_fast_malloc(&nal->rbsp_buffer, &nal->rbsp_buffer_size,
-                   length + padding);
+    av_fast_padded_malloc(&nal->rbsp_buffer, &nal->rbsp_buffer_size,
+                          length + padding);
     if (!nal->rbsp_buffer)
         return AVERROR(ENOMEM);