diff mbox series

[FFmpeg-devel] avcodec/libdav1d: use av_image_get_buffer_size() to calculate frame size

Message ID 20200717012939.9361-1-jamrial@gmail.com
State Accepted
Commit 5eb4405fc5da27583ee748268fc4e49a8c0c5b54
Headers show
Series [FFmpeg-devel] avcodec/libdav1d: use av_image_get_buffer_size() to calculate frame size | expand

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

James Almer July 17, 2020, 1:29 a.m. UTC 
Calling av_image_fill_arrays() with NULL as src argument may result in UB.

Signed-off-by: James Almer <jamrial@gmail.com>
---
It will still happen even after this patch because of the current
av_image_get_buffer_size() implementation, but will stop being the case after
the patchset by Brian Kim is applied.

 libavcodec/libdav1d.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/libavcodec/libdav1d.c b/libavcodec/libdav1d.c
index bbb3ec1e6c..132d344296 100644
--- a/libavcodec/libdav1d.c
+++ b/libavcodec/libdav1d.c
@@ -66,12 +66,11 @@  static int libdav1d_picture_allocator(Dav1dPicture *p, void *cookie)
 {
     Libdav1dContext *dav1d = cookie;
     enum AVPixelFormat format = pix_fmt[p->p.layout][p->seq_hdr->hbd];
-    int ret, linesize[4], h = FFALIGN(p->p.h, 128);
+    int ret, linesize[4], h = FFALIGN(p->p.h, 128), w = FFALIGN(p->p.w, 128);
     uint8_t *aligned_ptr, *data[4];
     AVBufferRef *buf;
 
-    ret = av_image_fill_arrays(data, linesize, NULL, format, FFALIGN(p->p.w, 128),
-                               h, DAV1D_PICTURE_ALIGNMENT);
+    ret = av_image_get_buffer_size(format, w, h, DAV1D_PICTURE_ALIGNMENT);
     if (ret < 0)
         return ret;
 
@@ -94,7 +93,8 @@  static int libdav1d_picture_allocator(Dav1dPicture *p, void *cookie)
     // Use the extra DAV1D_PICTURE_ALIGNMENT padding bytes in the buffer to align it
     // if required.
     aligned_ptr = (uint8_t *)FFALIGN((uintptr_t)buf->data, DAV1D_PICTURE_ALIGNMENT);
-    ret = av_image_fill_pointers(data, format, h, aligned_ptr, linesize);
+    ret = av_image_fill_arrays(data, linesize, aligned_ptr, format, w, h,
+                               DAV1D_PICTURE_ALIGNMENT);
     if (ret < 0) {
         av_buffer_unref(&buf);
         return ret;