From 6736de0ce628a2799ea4d1150b7a92a80f09c45a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 24 Mar 2012 14:25:52 +0100 Subject: [PATCH] mpegvideo: increase buffer sizes. Fixes buffer overflow Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit 2c0559d5e2faeafa7998173a4dc430408475503f) --- libavcodec/mpegvideo.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/mpegvideo.c b/libavcodec/mpegvideo.c index a02a77d16f..16803a00e6 100644 --- a/libavcodec/mpegvideo.c +++ b/libavcodec/mpegvideo.c @@ -422,12 +422,12 @@ static int init_duplicate_context(MpegEncContext *s, MpegEncContext *base) // edge emu needs blocksize + filter length - 1 // (= 17x17 for halfpel / 21x21 for h264) FF_ALLOCZ_OR_GOTO(s->avctx, s->edge_emu_buffer, - (s->width + 64) * 2 * 21 * 2, fail); // (width + edge + align)*interlaced*MBsize*tolerance + (s->width + 95) * 2 * 21 * 4, fail); // (width + edge + align)*interlaced*MBsize*tolerance // FIXME should be linesize instead of s->width * 2 // but that is not known before get_buffer() FF_ALLOCZ_OR_GOTO(s->avctx, s->me.scratchpad, - (s->width + 64) * 4 * 16 * 2 * sizeof(uint8_t), fail) + (s->width + 95) * 4 * 16 * 2 * sizeof(uint8_t), fail) s->me.temp = s->me.scratchpad; s->rd_scratchpad = s->me.scratchpad; s->b_scratchpad = s->me.scratchpad;