Browse Source

Avoid uninitialized data in lcldec when ofs is 0 in MSZH.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Reimar Döffinger 13 years ago
parent
commit
42a1f1d7a8
2 changed files with 7 additions and 4 deletions
  1. 7 1
      libavcodec/lcldec.c
  2. 0 3
      libavutil/lzo.h

+ 7 - 1
libavcodec/lcldec.c

@@ -96,7 +96,13 @@ static unsigned int mszh_decomp(const unsigned char * srcptr, int srclen, unsign
             ofs = FFMIN(ofs, destptr - destptr_bak);
             ofs = FFMIN(ofs, destptr - destptr_bak);
             cnt *= 4;
             cnt *= 4;
             cnt = FFMIN(cnt, destptr_end - destptr);
             cnt = FFMIN(cnt, destptr_end - destptr);
-            av_memcpy_backptr(destptr, ofs, cnt);
+            if (ofs) {
+                av_memcpy_backptr(destptr, ofs, cnt);
+            } else {
+                // Not known what the correct behaviour is, but
+                // this at least avoids uninitialized data.
+                memset(destptr, 0, cnt);
+            }
             destptr += cnt;
             destptr += cnt;
         }
         }
         maskbit >>= 1;
         maskbit >>= 1;

+ 0 - 3
libavutil/lzo.h

@@ -67,9 +67,6 @@ int av_lzo1x_decode(void *out, int *outlen, const void *in, int *inlen);
  *
  *
  * cnt > back is valid, this will copy the bytes we just copied,
  * cnt > back is valid, this will copy the bytes we just copied,
  * thus creating a repeating pattern with a period length of back.
  * thus creating a repeating pattern with a period length of back.
- * Note that lcldec currently can set back == 0 - which is wrong and
- * makes no sense, but the code should at least avoid crashing or hanging
- * for this case.
  */
  */
 void av_memcpy_backptr(uint8_t *dst, int back, int cnt);
 void av_memcpy_backptr(uint8_t *dst, int back, int cnt);