[FFmpeg-devel] [PATCH] rawdec: allocate a buffer in the appropriate size in the copy case.

[Hendrik Leppkes]

Otherwise the created buffer can be smaller than buf_size, which results
in buffer overreads if the original image has extra padding on every line.
---
 libavcodec/rawdec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 4699242..c9b6802 100644
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -190,7 +190,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
         return res;
 
     if (need_copy)
-        frame->buf[0] = av_buffer_alloc(context->frame_size);
+        frame->buf[0] = av_buffer_alloc(buf_size);
     else
         frame->buf[0] = av_buffer_ref(avpkt->buf);
     if (!frame->buf[0])
@@ -219,7 +219,7 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
         }
         buf = dst;
     } else if (need_copy) {
-        memcpy(frame->buf[0]->data, buf, FFMIN(buf_size, context->frame_size));
+        memcpy(frame->buf[0]->data, buf, buf_size);
         buf = frame->buf[0]->data;
     }
 
-- 
1.8.3.msysgit.0