| Index: chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch
|
| diff --git a/chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch b/chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..a29760740a17aa70ae4d6141d2028c9bb36096f5
|
| --- /dev/null
|
| +++ b/chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch
|
| @@ -0,0 +1,93 @@
|
| +Index: a/libavcodec/vp8.c
|
| +===================================================================
|
| +--- a/libavcodec/vp8.c (revision 105133)
|
| ++++ b/libavcodec/vp8.c (working copy)
|
| +@@ -33,6 +33,19 @@
|
| + # include "arm/vp8.h"
|
| + #endif
|
| +
|
| ++static void free_buffers(VP8Context *s)
|
| ++{
|
| ++ av_freep(&s->macroblocks_base);
|
| ++ av_freep(&s->filter_strength);
|
| ++ av_freep(&s->intra4x4_pred_mode_top);
|
| ++ av_freep(&s->top_nnz);
|
| ++ av_freep(&s->edge_emu_buffer);
|
| ++ av_freep(&s->top_border);
|
| ++ av_freep(&s->segmentation_map);
|
| ++
|
| ++ s->macroblocks = NULL;
|
| ++}
|
| ++
|
| + static void vp8_decode_flush(AVCodecContext *avctx)
|
| + {
|
| + VP8Context *s = avctx->priv_data;
|
| +@@ -45,15 +58,7 @@
|
| + }
|
| + memset(s->framep, 0, sizeof(s->framep));
|
| +
|
| +- av_freep(&s->macroblocks_base);
|
| +- av_freep(&s->filter_strength);
|
| +- av_freep(&s->intra4x4_pred_mode_top);
|
| +- av_freep(&s->top_nnz);
|
| +- av_freep(&s->edge_emu_buffer);
|
| +- av_freep(&s->top_border);
|
| +- av_freep(&s->segmentation_map);
|
| +-
|
| +- s->macroblocks = NULL;
|
| ++ free_buffers(s);
|
| + }
|
| +
|
| + static int update_dimensions(VP8Context *s, int width, int height)
|
| +@@ -273,7 +278,7 @@
|
| +
|
| + if (!s->macroblocks_base || /* first frame */
|
| + width != s->avctx->width || height != s->avctx->height) {
|
| +- if ((ret = update_dimensions(s, width, height) < 0))
|
| ++ if ((ret = update_dimensions(s, width, height)) < 0)
|
| + return ret;
|
| + }
|
| +
|
| +@@ -487,6 +492,7 @@
|
| +
|
| + AV_ZERO32(&near_mv[0]);
|
| + AV_ZERO32(&near_mv[1]);
|
| ++ AV_ZERO32(&near_mv[2]);
|
| +
|
| + /* Process MB on top, left and top-left */
|
| + #define MV_EDGE_CHECK(n)\
|
| +@@ -1749,6 +1755,11 @@
|
| + {
|
| + VP8Context *s = dst->priv_data, *s_src = src->priv_data;
|
| +
|
| ++ if (s->macroblocks_base &&
|
| ++ (s_src->mb_width != s->mb_width || s_src->mb_height != s->mb_height)) {
|
| ++ free_buffers(s);
|
| ++ }
|
| ++
|
| + s->prob[0] = s_src->prob[!s_src->update_probabilities];
|
| + s->segmentation = s_src->segmentation;
|
| + s->lf_delta = s_src->lf_delta;
|
| +Index: a/libavcodec/pthread.c
|
| +===================================================================
|
| +--- a/libavcodec/pthread.c (revision 105133)
|
| ++++ b/libavcodec/pthread.c (working copy)
|
| +@@ -332,6 +332,9 @@
|
| + dst->height = src->height;
|
| + dst->pix_fmt = src->pix_fmt;
|
| +
|
| ++ dst->coded_width = src->coded_width;
|
| ++ dst->coded_height = src->coded_height;
|
| ++
|
| + dst->has_b_frames = src->has_b_frames;
|
| + dst->idct_algo = src->idct_algo;
|
| + dst->slice_count = src->slice_count;
|
| +@@ -630,7 +633,7 @@
|
| +
|
| + park_frame_worker_threads(fctx, thread_count);
|
| +
|
| +- if (fctx->prev_thread)
|
| ++ if (fctx->prev_thread && fctx->prev_thread != fctx->threads)
|
| + update_context_from_thread(fctx->threads->avctx, fctx->prev_thread->avctx, 0);
|
| +
|
| + fctx->die = 1;
|
|
|