On 9/10/2019 2:38 AM, lance.lmw...@gmail.com wrote:
> From: Limin Wang <lance.lmw...@gmail.com>
>
> Signed-off-by: Limin Wang <lance.lmw...@gmail.com>
> ---
> libavcodec/h2645_parse.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)
>
> diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
> index 307e8643e6..f077900617 100644
> --- a/libavcodec/h2645_parse.c
> +++ b/libavcodec/h2645_parse.c
> @@ -453,16 +453,15 @@ int ff_h2645_packet_split(H2645Packet *pkt, const
> uint8_t *buf, int length,
> }
> }
>
> - if (pkt->nals_allocated < pkt->nb_nals + 1) {
> - int new_size = pkt->nals_allocated + 1;
> - void *tmp = av_realloc_array(pkt->nals, new_size,
> sizeof(*pkt->nals));
> + if (pkt->nb_nals >= pkt->nals_allocated) {
> + void *tmp = av_realloc_array(pkt->nals, pkt->nals_allocated + 1,
> sizeof(*pkt->nals));
>
> if (!tmp)
> return AVERROR(ENOMEM);
>
> pkt->nals = tmp;
> - memset(pkt->nals + pkt->nals_allocated, 0,
> - (new_size - pkt->nals_allocated) * sizeof(*pkt->nals));
> + memset(pkt->nals + pkt->nals_allocated, 0, sizeof(*pkt->nals));
> + pkt->nals_allocated++;
The nal->skipped_bytes_pos allocation below can still fail. This counter
shouldn't increase until all allocations have succeeded.
>
> nal = &pkt->nals[pkt->nb_nals];
> nal->skipped_bytes_pos_size = 1024; // initial buffer size
> @@ -470,7 +469,6 @@ int ff_h2645_packet_split(H2645Packet *pkt, const uint8_t
> *buf, int length,
> if (!nal->skipped_bytes_pos)
> return AVERROR(ENOMEM);
>
> - pkt->nals_allocated = new_size;
> }
> nal = &pkt->nals[pkt->nb_nals];
>
>
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
