pcx: properly pad the scanline
diff mbox

Message ID 20161124222952.7760D5DACC@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau Nov. 24, 2016, 10:29 p.m. 
Module: libav
Branch: master
Commit: 15ee419b7abaf17f8c662c145fe93d3dbf43282b

Author:    Anton Khirnov <anton@khirnov.net>
Committer: Anton Khirnov <anton@khirnov.net>
Date:      Sun Aug 14 10:18:39 2016 +0200

pcx: properly pad the scanline

It is passed to the get_bits API, which requires buffers to be padded.

Fixes possible invalid reads.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

---

 libavcodec/pcx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch
diff mbox 

diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c
index aa69d51..77b2331 100644
--- a/libavcodec/pcx.c
+++ b/libavcodec/pcx.c
@@ -148,7 +148,7 @@  static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
     ptr    = p->data[0];
     stride = p->linesize[0];
 
-    scanline = av_malloc(bytes_per_scanline);
+    scanline = av_malloc(bytes_per_scanline + AV_INPUT_BUFFER_PADDING_SIZE);
     if (!scanline)
         return AVERROR(ENOMEM);