[FFmpeg-devel] [PATCH] Fix memory allocation problem. Related to ticket #9264.

[Marton Balint]

On Tue, 8 Jun 2021, houlei at uniontech.com wrote:

> From: houlei <houlei at uniontech.com>
>
> Signed-off-by: houlei <houlei at uniontech.com>
> ---
> libavdevice/xv.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/libavdevice/xv.c b/libavdevice/xv.c
> index 24ba3179f6..7e15c178b6 100644
> --- a/libavdevice/xv.c
> +++ b/libavdevice/xv.c
> @@ -296,10 +296,11 @@ static int write_picture(AVFormatContext *s, uint8_t *input_data[4],
> {
>     XVContext *xv = s->priv_data;
>     XvImage *img = xv->yuv_image;
> -    uint8_t *data[3] = {
> +    uint8_t *data[4] = {
>         img->data + img->offsets[0],
>         img->data + img->offsets[1],
> -        img->data + img->offsets[2]
> +        img->data + img->offsets[2],
> +        img->data + img->offsets[3]

This does not look good, img->offsets[3] is probably not valid, because 
img->offsets and img->pitches are both arrays of img->num_planes, which is 
3... So to be correct, img->pitches should also be copied to a 4 long 
array, and that should be passed to av_image_copy, but the 4th value can 
be left as 0 both for pitches and data.

Regards,
Marton

>     };
>
>     /* Check messages. Window might get closed. */
> -- 
> 2.20.1
>
>
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".
>