| Index: chromium/patches/to_upstream/47_vp3_fix_infloop_and_memleak.patch
|
| diff --git a/chromium/patches/to_upstream/47_vp3_fix_infloop_and_memleak.patch b/chromium/patches/to_upstream/47_vp3_fix_infloop_and_memleak.patch
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..b1729aee41d507e8693a9a78882cf32d1b9c2a5c
|
| --- /dev/null
|
| +++ b/chromium/patches/to_upstream/47_vp3_fix_infloop_and_memleak.patch
|
| @@ -0,0 +1,129 @@
|
| +diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
|
| +index 17c097e..ce14e63 100644
|
| +--- a/libavcodec/vp3.c
|
| ++++ b/libavcodec/vp3.c
|
| +@@ -45,6 +45,7 @@
|
| + #define FRAGMENT_PIXELS 8
|
| +
|
| + static av_cold int vp3_decode_end(AVCodecContext *avctx);
|
| ++static void vp3_decode_flush(AVCodecContext *avctx);
|
| +
|
| + //FIXME split things out into their own arrays
|
| + typedef struct Vp3Fragment {
|
| +@@ -942,6 +943,10 @@ static int unpack_vlcs(Vp3DecodeContext *s, GetBitContext *gb,
|
| + for (i = coeff_index+1; i <= coeff_index+zero_run; i++)
|
| + s->num_coded_frags[plane][i]--;
|
| + coeff_i++;
|
| ++ } else {
|
| ++ av_log(s->avctx, AV_LOG_ERROR,
|
| ++ "Invalid token %d\n", token);
|
| ++ return -1;
|
| + }
|
| + }
|
| +
|
| +@@ -991,6 +996,8 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
|
| + /* unpack the Y plane DC coefficients */
|
| + residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_y_table], 0,
|
| + 0, residual_eob_run);
|
| ++ if (residual_eob_run < 0)
|
| ++ return residual_eob_run;
|
| +
|
| + /* reverse prediction of the Y-plane DC coefficients */
|
| + reverse_dc_prediction(s, 0, s->fragment_width[0], s->fragment_height[0]);
|
| +@@ -998,8 +1005,12 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
|
| + /* unpack the C plane DC coefficients */
|
| + residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
|
| + 1, residual_eob_run);
|
| ++ if (residual_eob_run < 0)
|
| ++ return residual_eob_run;
|
| + residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0,
|
| + 2, residual_eob_run);
|
| ++ if (residual_eob_run < 0)
|
| ++ return residual_eob_run;
|
| +
|
| + /* reverse prediction of the C-plane DC coefficients */
|
| + if (!(s->avctx->flags & CODEC_FLAG_GRAY))
|
| +@@ -1036,11 +1047,17 @@ static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb)
|
| + for (i = 1; i <= 63; i++) {
|
| + residual_eob_run = unpack_vlcs(s, gb, y_tables[i], i,
|
| + 0, residual_eob_run);
|
| ++ if (residual_eob_run < 0)
|
| ++ return residual_eob_run;
|
| +
|
| + residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
|
| + 1, residual_eob_run);
|
| ++ if (residual_eob_run < 0)
|
| ++ return residual_eob_run;
|
| + residual_eob_run = unpack_vlcs(s, gb, c_tables[i], i,
|
| + 2, residual_eob_run);
|
| ++ if (residual_eob_run < 0)
|
| ++ return residual_eob_run;
|
| + }
|
| +
|
| + return 0;
|
| +@@ -1990,9 +2007,6 @@ static av_cold int vp3_decode_end(AVCodecContext *avctx)
|
| + Vp3DecodeContext *s = avctx->priv_data;
|
| + int i;
|
| +
|
| +- if (avctx->is_copy && !s->current_frame.data[0])
|
| +- return 0;
|
| +-
|
| + av_free(s->superblock_coding);
|
| + av_free(s->all_fragments);
|
| + av_free(s->coded_fragment_list[0]);
|
| +@@ -2019,12 +2033,7 @@ static av_cold int vp3_decode_end(AVCodecContext *avctx)
|
| + free_vlc(&s->motion_vector_vlc);
|
| +
|
| + /* release all frames */
|
| +- if (s->golden_frame.data[0])
|
| +- ff_thread_release_buffer(avctx, &s->golden_frame);
|
| +- if (s->last_frame.data[0] && s->last_frame.type != FF_BUFFER_TYPE_COPY)
|
| +- ff_thread_release_buffer(avctx, &s->last_frame);
|
| +- /* no need to release the current_frame since it will always be pointing
|
| +- * to the same frame as either the golden or last frame */
|
| ++ vp3_decode_flush(avctx);
|
| +
|
| + return 0;
|
| + }
|
| +@@ -2344,6 +2353,23 @@ static void vp3_decode_flush(AVCodecContext *avctx)
|
| + ff_thread_release_buffer(avctx, &s->current_frame);
|
| + }
|
| +
|
| ++static int vp3_init_thread_copy(AVCodecContext *avctx)
|
| ++{
|
| ++ Vp3DecodeContext *s = avctx->priv_data;
|
| ++
|
| ++ s->superblock_coding = NULL;
|
| ++ s->all_fragments = NULL;
|
| ++ s->coded_fragment_list[0] = NULL;
|
| ++ s->dct_tokens_base = NULL;
|
| ++ s->superblock_fragments = NULL;
|
| ++ s->macroblock_coding = NULL;
|
| ++ s->motion_val[0] = NULL;
|
| ++ s->motion_val[1] = NULL;
|
| ++ s->edge_emu_buffer = NULL;
|
| ++
|
| ++ return 0;
|
| ++}
|
| ++
|
| + AVCodec ff_theora_decoder = {
|
| + .name = "theora",
|
| + .type = AVMEDIA_TYPE_VIDEO,
|
| +@@ -2355,6 +2381,7 @@ AVCodec ff_theora_decoder = {
|
| + .capabilities = CODEC_CAP_DR1 | CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_FRAME_THREADS,
|
| + .flush = vp3_decode_flush,
|
| + .long_name = NULL_IF_CONFIG_SMALL("Theora"),
|
| ++ .init_thread_copy = ONLY_IF_THREADS_ENABLED(vp3_init_thread_copy),
|
| + .update_thread_context = ONLY_IF_THREADS_ENABLED(vp3_update_thread_context)
|
| + };
|
| + #endif
|
| +@@ -2370,5 +2397,6 @@ AVCodec ff_vp3_decoder = {
|
| + .capabilities = CODEC_CAP_DR1 | CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_FRAME_THREADS,
|
| + .flush = vp3_decode_flush,
|
| + .long_name = NULL_IF_CONFIG_SMALL("On2 VP3"),
|
| ++ .init_thread_copy = ONLY_IF_THREADS_ENABLED(vp3_init_thread_copy),
|
| + .update_thread_context = ONLY_IF_THREADS_ENABLED(vp3_update_thread_context)
|
| + };
|
| +--
|
| +1.7.2.1
|
| +
|
|
|