hxxx_nal: remove useless optim
authorThomas Guillem <thomas@gllm.fr>
Wed, 27 May 2020 11:02:08 +0000 (13:02 +0200)
committerHugo Beauzée-Luyssen <hugo@beauzee.fr>
Thu, 4 Jun 2020 12:24:17 +0000 (14:24 +0200)
This special case is now useless since p_source is always copied to p_dest,
right after in the memmove loop.

Furthermore, this caused an invalid payload size when the buffer was actually
reallocated since the payload calculation was comparing two different buffers
offset.

CVE-2020-13428

Signed-off-by: Hugo Beauzée-Luyssen <hugo@beauzee.fr>
(cherry picked from commit 56822f03d7a498bb22257d6075723c0e1c7f91fe)
Signed-off-by: Hugo Beauzée-Luyssen <hugo@beauzee.fr>
modules/packetizer/hxxx_nal.c

index 7345060..6bdfd5a 100644 (file)
@@ -122,20 +122,6 @@ block_t *hxxx_AnnexB_to_xVC( block_t *p_block, uint8_t i_nal_length_size )
 
     if( p_list[i_nalcount - 1].move != 0 || i_nal_length_size != 4 )  /* We'll need to grow or shrink */
     {
-        /* If we grow in size, try using realloc to avoid memcpy */
-        if( p_list[i_nalcount - 1].move > 0 && block_WillRealloc( p_block, 0, i_dest ) )
-        {
-            uint32_t i_sizebackup = p_block->i_buffer;
-            block_t *p_newblock = block_Realloc( p_block, 0, i_dest );
-            if( unlikely(!p_newblock) )
-                goto error;
-
-            p_block = p_newblock;
-            p_sourceend = &p_block->p_buffer[i_sizebackup];
-            p_source = p_dest = p_block->p_buffer;
-        }
-        else
-        {
             block_t *p_newblock = block_Alloc( i_dest );
             if( unlikely(!p_newblock) )
                 goto error;
@@ -146,7 +132,6 @@ block_t *hxxx_AnnexB_to_xVC( block_t *p_block, uint8_t i_nal_length_size )
 
             p_block = p_newblock;
             p_dest = p_newblock->p_buffer;
-        }
     }
     else
     {