[MPlayer-cvslog] CVS: main/libmpcodecs vd_libmpeg2.c, 1.40, 1.41 vf.c, 1.126, 1.127

[Uoti Urpala CVS]

CVS change done by Uoti Urpala CVS

Update of /cvsroot/mplayer/main/libmpcodecs
In directory mail:/var2/tmp/cvs-serv27646/libmpcodecs

Modified Files:
	vd_libmpeg2.c vf.c 
Log Message:
Fix memory corruption in vd_libmpeg2


Index: vd_libmpeg2.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpcodecs/vd_libmpeg2.c,v
retrieving revision 1.40
retrieving revision 1.41
diff -u -r1.40 -r1.41
--- vd_libmpeg2.c	18 Nov 2005 14:39:22 -0000	1.40
+++ vd_libmpeg2.c	27 Apr 2006 02:46:33 -0000	1.41
@@ -29,9 +29,16 @@
 
 #include "cpudetect.h"
 
+typedef struct {
+    mpeg2dec_t *mpeg2dec;
+    int quant_store_idx;
+    char *quant_store[3];
+} vd_libmpeg2_ctx_t;
+
 // to set/get/query special features/parameters
 static int control(sh_video_t *sh,int cmd,void* arg,...){
-    mpeg2dec_t * mpeg2dec = sh->context;
+    vd_libmpeg2_ctx_t *context = sh->context;
+    mpeg2dec_t * mpeg2dec = context->mpeg2dec;
     const mpeg2_info_t * info = mpeg2_info (mpeg2dec);
 
     switch(cmd) {
@@ -52,6 +59,7 @@
 
 // init driver
 static int init(sh_video_t *sh){
+    vd_libmpeg2_ctx_t *context;
     mpeg2dec_t * mpeg2dec;
 //    const mpeg2_info_t * info;
     int accel;
@@ -75,8 +83,10 @@
     if(!mpeg2dec) return 0;
 
     mpeg2_custom_fbuf(mpeg2dec,1); // enable DR1
-    
-    sh->context=mpeg2dec;
+
+    context = calloc(1, sizeof(vd_libmpeg2_ctx_t));
+    context->mpeg2dec = mpeg2dec;
+    sh->context = context;
 
     mpeg2dec->pending_buffer = 0;
     mpeg2dec->pending_length = 0;
@@ -86,16 +96,22 @@
 
 // uninit driver
 static void uninit(sh_video_t *sh){
-    mpeg2dec_t * mpeg2dec = sh->context;
+    int i;
+    vd_libmpeg2_ctx_t *context = sh->context;
+    mpeg2dec_t * mpeg2dec = context->mpeg2dec;
     if (mpeg2dec->pending_buffer) free(mpeg2dec->pending_buffer);
     mpeg2dec->decoder.convert=NULL;
     mpeg2dec->decoder.convert_id=NULL;
     mpeg2_close (mpeg2dec);
+    for (i=0; i < 3; i++)
+	free(context->quant_store[i]);
+    free(sh->context);
 }
 
 static void draw_slice (void * _sh, uint8_t * const * src, unsigned int y){ 
     sh_video_t* sh = (sh_video_t*) _sh;
-    mpeg2dec_t* mpeg2dec = sh->context;
+    vd_libmpeg2_ctx_t *context = sh->context;
+    mpeg2dec_t* mpeg2dec = context->mpeg2dec;
     const mpeg2_info_t * info = mpeg2_info (mpeg2dec);
     int stride[3];
 
@@ -113,7 +129,8 @@
 
 // decode a frame
 static mp_image_t* decode(sh_video_t *sh,void* data,int len,int flags){
-    mpeg2dec_t * mpeg2dec = sh->context;
+    vd_libmpeg2_ctx_t *context = sh->context;
+    mpeg2dec_t * mpeg2dec = context->mpeg2dec;
     const mpeg2_info_t * info = mpeg2_info (mpeg2dec);
     int drop_frame, framedrop=flags&3;
 
@@ -200,9 +217,12 @@
 	    mpi_new->fields |= MP_IMGFIELD_ORDERED;
 
 #ifdef MPEG12_POSTPROC
-	    if(!mpi_new->qscale){
-		mpi_new->qstride=info->sequence->width>>4;
-		mpi_new->qscale=malloc(mpi_new->qstride*(info->sequence->height>>4));
+	    mpi_new->qstride=info->sequence->width>>4;
+	    {
+	    char **p = &context->quant_store[type==PIC_FLAG_CODING_TYPE_B ?
+					2 : (context->quant_store_idx ^= 1)];
+	    *p = realloc(*p, mpi_new->qstride*(info->sequence->height>>4));
+	    mpi_new->qscale = *p;
 	    }
 	    mpeg2dec->decoder.quant_store=mpi_new->qscale;
 	    mpeg2dec->decoder.quant_stride=mpi_new->qstride;

Index: vf.c
===================================================================
RCS file: /cvsroot/mplayer/main/libmpcodecs/vf.c,v
retrieving revision 1.126
retrieving revision 1.127
diff -u -r1.126 -r1.127
--- vf.c	31 Mar 2006 00:15:47 -0000	1.126
+++ vf.c	27 Apr 2006 02:46:33 -0000	1.127
@@ -412,6 +412,7 @@
 	    mpi->flags|=MP_IMGFLAG_TYPE_DISPLAYED;
     }
 
+  mpi->qscale = NULL;
   }
 //    printf("\rVF_MPI: %p %p %p %d %d %d    \n",
 //	mpi->planes[0],mpi->planes[1],mpi->planes[2],