[FFmpeg-devel] [PATCH] pngdec: use av_fast_padded_malloc(z)

[Paul B Mahol]

On 8/22/13, Michael Niedermayer <michaelni at gmx.at> wrote:
> On Thu, Aug 22, 2013 at 05:06:52PM +0000, Paul B Mahol wrote:
>> Signed-off-by: Paul B Mahol <onemda at gmail.com>
>> ---
>>  libavcodec/pngdec.c | 17 +++++++++--------
>>  1 file changed, 9 insertions(+), 8 deletions(-)
>>
>> diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
>> index 16225db..78f0c83 100644
>> --- a/libavcodec/pngdec.c
>> +++ b/libavcodec/pngdec.c
>> @@ -60,7 +60,10 @@ typedef struct PNGDecContext {
>>      uint32_t palette[256];
>>      uint8_t *crow_buf;
>>      uint8_t *last_row;
>> +    int last_row_size;
>>      uint8_t *tmp_row;
>> +    uint8_t *buffer;
>> +    int buffer_size;
>>      int pass;
>>      int crow_size; /* compressed row size (include filter type) */
>>      int row_size; /* decompressed row size */
>> @@ -509,7 +512,6 @@ static int decode_frame(AVCodecContext *avctx,
>>      int buf_size            = avpkt->size;
>>      AVFrame *p;
>>      AVDictionary *metadata  = NULL;
>> -    uint8_t *crow_buf_base  = NULL;
>>      uint32_t tag, length;
>>      int64_t sig;
>>      int ret;
>> @@ -667,7 +669,7 @@ static int decode_frame(AVCodecContext *avctx,
>>                  if (avctx->pix_fmt == AV_PIX_FMT_PAL8)
>>                      memcpy(p->data[1], s->palette, 256 *
>> sizeof(uint32_t));
>>                  /* empty row is used if differencing to the first row */
>> -                s->last_row = av_mallocz(s->row_size);
>> +                av_fast_padded_mallocz(&s->last_row, &s->last_row_size,
>> s->row_size);
>>                  if (!s->last_row)
>>                      goto fail;
>>                  if (s->interlace_type ||
>> @@ -677,12 +679,12 @@ static int decode_frame(AVCodecContext *avctx,
>>                          goto fail;
>>                  }
>>                  /* compressed row */
>> -                crow_buf_base = av_malloc(s->row_size + 16);
>> -                if (!crow_buf_base)
>> +                av_fast_padded_malloc(&s->buffer, &s->buffer_size,
>> s->row_size + 16);
>> +                if (!s->buffer)
>>                      goto fail;
>>
>>                  /* we want crow_buf+1 to be 16-byte aligned */
>> -                s->crow_buf          = crow_buf_base + 15;
>> +                s->crow_buf          = s->buffer + 15;
>>                  s->zstream.avail_out = s->crow_size;
>>                  s->zstream.next_out  = s->crow_buf;
>>              }
>> @@ -861,9 +863,6 @@ static int decode_frame(AVCodecContext *avctx,
>>      ret = bytestream2_tell(&s->gb);
>>   the_end:
>>      inflateEnd(&s->zstream);
>> -    av_free(crow_buf_base);
>
>> -    s->crow_buf = NULL;
>
> this should stay
>
>
>> -    av_freep(&s->last_row);
>>      av_freep(&s->tmp_row);
>>      return ret;
>>   fail:
>> @@ -914,6 +913,8 @@ static av_cold int png_dec_end(AVCodecContext *avctx)
>>      av_frame_free(&s->last_picture.f);
>>      ff_thread_release_buffer(avctx, &s->picture);
>>      av_frame_free(&s->picture.f);
>> +    av_freep(&s->buffer);
>> +    av_freep(&s->last_row);
>
> for saftey buffer_size / last_row_size should be rest here too
>
> otherwise LGTM

fixed all and applied

>
> [...]
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Avoid a single point of failure, be that a person or equipment.
>