Fix valgrind and asan memory leaks and crashes.

libavcodec/vp3.c

 /*
  * Copyright (C) 2003-2004 the ffmpeg project
  *
  * This file is part of FFmpeg.
  *
  * FFmpeg is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
  * License as published by the Free Software Foundation; either
  * version 2.1 of the License, or (at your option) any later version.
  *
@@ skipping 1613 matching lines @@
     Vp3DecodeContext *s = avctx->priv_data;
     int y_fragment_count, c_fragment_count;
 
     y_fragment_count = s->fragment_width[0] * s->fragment_height[0];
     c_fragment_count = s->fragment_width[1] * s->fragment_height[1];
 
     s->superblock_coding = av_malloc(s->superblock_count);
     s->all_fragments = av_malloc(s->fragment_count * sizeof(Vp3Fragment));
     s->coded_fragment_list[0] = av_malloc(s->fragment_count * sizeof(int));
     s->dct_tokens_base = av_malloc(64*s->fragment_count * sizeof(*s->dct_tokens_base));
+    memset(s->dct_tokens_base, 0, 64*s->fragment_count * sizeof(*s->dct_tokens_base));

[rbultje1, 2012/02/08 23:51:56]

Use av_mallocz() instead of av_malloc() to zero it automatically.

[DaleCurtis, 2012/02/09 04:03:28]

Done.

     s->motion_val[0] = av_malloc(y_fragment_count * sizeof(*s->motion_val[0]));
     s->motion_val[1] = av_malloc(c_fragment_count * sizeof(*s->motion_val[1]));
 
     /* work out the block mapping tables */
     s->superblock_fragments = av_malloc(s->superblock_count * 16 * sizeof(int));
     s->macroblock_coding = av_malloc(s->macroblock_count + 1);
 
     if (!s->superblock_coding || !s->all_fragments || !s->dct_tokens_base ||
         !s->coded_fragment_list[0] || !s->superblock_fragments || !s->macroblock_coding ||
         !s->motion_val[0] || !s->motion_val[1]) {
@@ skipping 747 matching lines @@
     .priv_data_size = sizeof(Vp3DecodeContext),
     .init           = vp3_decode_init,
     .close          = vp3_decode_end,
     .decode         = vp3_decode_frame,
     .capabilities   = CODEC_CAP_DR1 | CODEC_CAP_DRAW_HORIZ_BAND | CODEC_CAP_FRAME_THREADS,
     .flush = vp3_decode_flush,
     .long_name = NULL_IF_CONFIG_SMALL("On2 VP3"),
     .init_thread_copy      = ONLY_IF_THREADS_ENABLED(vp3_init_thread_copy),
     .update_thread_context = ONLY_IF_THREADS_ENABLED(vp3_update_thread_context)
 };