Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(194)

Unified Diff: chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch

Issue 9290059: Initial commit of all previous Chrome build scripts. (Closed) Base URL: http://git.chromium.org/chromium/third_party/ffmpeg.git@master
Patch Set: Drop deprecated subfolder. Created 8 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch
diff --git a/chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch b/chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a29760740a17aa70ae4d6141d2028c9bb36096f5
--- /dev/null
+++ b/chromium/patches/to_upstream/39_VP8_fix_oob_read_writes.patch
@@ -0,0 +1,93 @@
+Index: a/libavcodec/vp8.c
+===================================================================
+--- a/libavcodec/vp8.c (revision 105133)
++++ b/libavcodec/vp8.c (working copy)
+@@ -33,6 +33,19 @@
+ # include "arm/vp8.h"
+ #endif
+
++static void free_buffers(VP8Context *s)
++{
++ av_freep(&s->macroblocks_base);
++ av_freep(&s->filter_strength);
++ av_freep(&s->intra4x4_pred_mode_top);
++ av_freep(&s->top_nnz);
++ av_freep(&s->edge_emu_buffer);
++ av_freep(&s->top_border);
++ av_freep(&s->segmentation_map);
++
++ s->macroblocks = NULL;
++}
++
+ static void vp8_decode_flush(AVCodecContext *avctx)
+ {
+ VP8Context *s = avctx->priv_data;
+@@ -45,15 +58,7 @@
+ }
+ memset(s->framep, 0, sizeof(s->framep));
+
+- av_freep(&s->macroblocks_base);
+- av_freep(&s->filter_strength);
+- av_freep(&s->intra4x4_pred_mode_top);
+- av_freep(&s->top_nnz);
+- av_freep(&s->edge_emu_buffer);
+- av_freep(&s->top_border);
+- av_freep(&s->segmentation_map);
+-
+- s->macroblocks = NULL;
++ free_buffers(s);
+ }
+
+ static int update_dimensions(VP8Context *s, int width, int height)
+@@ -273,7 +278,7 @@
+
+ if (!s->macroblocks_base || /* first frame */
+ width != s->avctx->width || height != s->avctx->height) {
+- if ((ret = update_dimensions(s, width, height) < 0))
++ if ((ret = update_dimensions(s, width, height)) < 0)
+ return ret;
+ }
+
+@@ -487,6 +492,7 @@
+
+ AV_ZERO32(&near_mv[0]);
+ AV_ZERO32(&near_mv[1]);
++ AV_ZERO32(&near_mv[2]);
+
+ /* Process MB on top, left and top-left */
+ #define MV_EDGE_CHECK(n)\
+@@ -1749,6 +1755,11 @@
+ {
+ VP8Context *s = dst->priv_data, *s_src = src->priv_data;
+
++ if (s->macroblocks_base &&
++ (s_src->mb_width != s->mb_width || s_src->mb_height != s->mb_height)) {
++ free_buffers(s);
++ }
++
+ s->prob[0] = s_src->prob[!s_src->update_probabilities];
+ s->segmentation = s_src->segmentation;
+ s->lf_delta = s_src->lf_delta;
+Index: a/libavcodec/pthread.c
+===================================================================
+--- a/libavcodec/pthread.c (revision 105133)
++++ b/libavcodec/pthread.c (working copy)
+@@ -332,6 +332,9 @@
+ dst->height = src->height;
+ dst->pix_fmt = src->pix_fmt;
+
++ dst->coded_width = src->coded_width;
++ dst->coded_height = src->coded_height;
++
+ dst->has_b_frames = src->has_b_frames;
+ dst->idct_algo = src->idct_algo;
+ dst->slice_count = src->slice_count;
+@@ -630,7 +633,7 @@
+
+ park_frame_worker_threads(fctx, thread_count);
+
+- if (fctx->prev_thread)
++ if (fctx->prev_thread && fctx->prev_thread != fctx->threads)
+ update_context_from_thread(fctx->threads->avctx, fctx->prev_thread->avctx, 0);
+
+ fctx->die = 1;

Powered by Google App Engine
This is Rietveld 408576698