[PR] libavcodec, libavformat: use overflow-checked allocation wrappers (PR #23892)
Thalha Ahmed via ffmpeg-devel <[email protected]> Fri, 24 Jul 2026 12:11:37 -0000
| Newsgroups | gmane.comp.video.ffmpeg.devel |
|---|---|
| Message-ID | <178489509772.59.11722561488393569962@29965ddac10e> |
PR #23892 opened by Thalha Ahmed (thalha-a9) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23892 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23892.patch This patch migrates 93 allocation call sites across 38 files from unchecked av_malloc(a * b) / av_mallocz(a * b) to the overflow-checked av_malloc_array(a, b) / av_calloc(a, b) wrappers. Many decoders and demuxers compute allocation sizes by multiplying values parsed from input files (width, height, mb_stride, nb_entries, coupling_steps, etc.). If the multiplication overflows, a small buffer is allocated while the subsequent code writes the full amount, causing a heap buffer overflow. av_malloc_array() and av_calloc() validate that the multiplication does not overflow before allocating memory. All affected sites already check for NULL returns, so this is a safe mechanical replacement with no functional change for legitimate inputs. 38 files changed, 93 insertions, 93 deletions Signedoff by: Thalha Ahmed <[email protected]> >From 0d628bd8b5df2ba491486aa6ad4656f1f1c0cb44 Mon Sep 17 00:00:00 2001 From: Thalha Ahmed <[email protected]> Date: Fri, 24 Jul 2026 17:27:17 +0530 Subject: [PATCH] libavcodec, libavformat: use overflow-checked allocation wrappers Replace unchecked av_malloc(a * b) with av_malloc_array(a, b) and av_mallocz(a * b) with av_calloc(a, b) across 38 files in libavcodec and libavformat. When processing untrusted media files, allocation sizes are computed from attacker-controlled values (width, height, mb_stride, nb_entries, etc.). If the multiplication overflows, av_malloc() allocates a small buffer while subsequent code writes the full (untruncated) amount, causing heap buffer overflow. av_malloc_array() and av_calloc() check for overflow before multiplying, returning NULL on overflow. All affected call sites already handle NULL returns via existing ENOMEM error paths, so this is a safe mechanical replacement with no functional change for legitimate inputs. Signed-off-by: Thalha Ahmed <[email protected]> --- libavcodec/4xm.c | 4 ++-- libavcodec/cinepakenc.c | 2 +- libavcodec/cuviddec.c | 2 +- libavcodec/dvdsubdec.c | 4 ++-- libavcodec/escape130.c | 6 +++--- libavcodec/hnm4video.c | 6 +++--- libavcodec/huffyuvenc.c | 2 +- libavcodec/iff.c | 6 +++--- libavcodec/ivi.c | 2 +- libavcodec/jpeg2000dec.c | 2 +- libavcodec/kgv1dec.c | 4 ++-- libavcodec/magicyuvenc.c | 2 +- libavcodec/mss2.c | 4 ++-- libavcodec/msvideo1enc.c | 2 +- libavcodec/nvenc.c | 2 +- libavcodec/ratecontrol.c | 2 +- libavcodec/rl2.c | 2 +- libavcodec/rv34.c | 12 ++++++------ libavcodec/sgienc.c | 2 +- libavcodec/svq1enc.c | 12 ++++++------ libavcodec/svq3.c | 4 ++-- libavcodec/tiff.c | 2 +- libavcodec/tscc2.c | 2 +- libavcodec/utvideoenc.c | 2 +- libavcodec/v4l2_context.c | 2 +- libavcodec/vb.c | 4 ++-- libavcodec/vc1dec.c | 30 +++++++++++++++--------------- libavcodec/vc2enc.c | 2 +- libavcodec/vorbisdec.c | 18 +++++++++--------- libavcodec/vp8.c | 14 +++++++------- libavcodec/vqcdec.c | 2 +- libavcodec/xsubdec.c | 2 +- libavformat/dashenc.c | 2 +- libavformat/demux.c | 2 +- libavformat/flvdec.c | 2 +- libavformat/hlsenc.c | 10 +++++----- libavformat/jvdec.c | 4 ++-- libavformat/mov.c | 2 +- 38 files changed, 93 insertions(+), 93 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index c6b2ce1230..6da4b89b51 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -1014,8 +1014,8 @@ static av_cold int decode_init(AVCodecContext *avctx) if (ret < 0) return ret; - f->frame_buffer = av_mallocz(avctx->width * avctx->height * 2); - f->last_frame_buffer = av_mallocz(avctx->width * avctx->height * 2); + f->frame_buffer = av_calloc(avctx->width * (size_t)avctx->height, 2); + f->last_frame_buffer = av_calloc(avctx->width * (size_t)avctx->height, 2); if (!f->frame_buffer || !f->last_frame_buffer) return AVERROR(ENOMEM); diff --git a/libavcodec/cinepakenc.c b/libavcodec/cinepakenc.c index 104a9f485e..0c170ccf29 100644 --- a/libavcodec/cinepakenc.c +++ b/libavcodec/cinepakenc.c @@ -186,7 +186,7 @@ static av_cold int cinepak_encode_init(AVCodecContext *avctx) return AVERROR(ENOMEM); for (x = 0; x < (avctx->pix_fmt == AV_PIX_FMT_RGB24 ? 4 : 3); x++) - if (!(s->pict_bufs[x] = av_malloc((avctx->pix_fmt == AV_PIX_FMT_RGB24 ? 6 : 4) * (avctx->width * avctx->height) >> 2))) + if (!(s->pict_bufs[x] = av_malloc_array((avctx->pix_fmt == AV_PIX_FMT_RGB24 ? 6 : 4), (size_t)avctx->width * avctx->height >> 2))) return AVERROR(ENOMEM); mb_count = avctx->width * avctx->height / MB_AREA; diff --git a/libavcodec/cuviddec.c b/libavcodec/cuviddec.c index 3c8faae3c8..32da57440a 100644 --- a/libavcodec/cuviddec.c +++ b/libavcodec/cuviddec.c @@ -1641,7 +1641,7 @@ static av_cold int cuvid_decode_init(AVCodecContext *avctx) ctx->cuparseinfo.pExtVideoInfo = ctx->cuparse_ext; - ctx->key_frame = av_mallocz(ctx->nb_surfaces * sizeof(int)); + ctx->key_frame = av_calloc(ctx->nb_surfaces, sizeof(int)); if (!ctx->key_frame) { ret = AVERROR(ENOMEM); goto error; diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 9f9845bf8e..baa2536bc3 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -378,7 +378,7 @@ static int decode_dvd_subtitles(void *logctx, DVDSubContext *ctx, if (!sub_header->rects[0]) goto fail; sub_header->num_rects = 1; - bitmap = sub_header->rects[0]->data[0] = av_malloc(w * h); + bitmap = sub_header->rects[0]->data[0] = av_malloc_array(w, h); if (!bitmap) goto fail; if (decode_rle(bitmap, w * 2, w, (h + 1) / 2, ctx->used_color, @@ -481,7 +481,7 @@ static int find_smallest_bounding_rectangle(DVDSubContext *ctx, AVSubtitle *s) x2--; w = x2 - x1 + 1; h = y2 - y1 + 1; - bitmap = av_malloc(w * h); + bitmap = av_malloc_array(w, h); if (!bitmap) return 1; for(y = 0; y < h; y++) { diff --git a/libavcodec/escape130.c b/libavcodec/escape130.c index a192831144..8032f6f4fb 100644 --- a/libavcodec/escape130.c +++ b/libavcodec/escape130.c @@ -125,9 +125,9 @@ static av_cold int escape130_decode_init(AVCodecContext *avctx) return AVERROR_INVALIDDATA; } - s->old_y_avg = av_mallocz(avctx->width * avctx->height / 4); - s->buf1 = av_malloc(avctx->width * avctx->height * 3 / 2); - s->buf2 = av_malloc(avctx->width * avctx->height * 3 / 2); + s->old_y_avg = av_calloc(avctx->width / 2, avctx->height / 2); + s->buf1 = av_malloc_array(avctx->width * (size_t)3, avctx->height / 2); + s->buf2 = av_malloc_array(avctx->width * (size_t)3, avctx->height / 2); if (!s->old_y_avg || !s->buf1 || !s->buf2) { av_log(avctx, AV_LOG_ERROR, "Could not allocate buffer.\n"); return AVERROR(ENOMEM); diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c index 51e75789d2..c149a10226 100644 --- a/libavcodec/hnm4video.c +++ b/libavcodec/hnm4video.c @@ -471,9 +471,9 @@ static av_cold int hnm_decode_init(AVCodecContext *avctx) avctx->pix_fmt = AV_PIX_FMT_PAL8; hnm->width = avctx->width; hnm->height = avctx->height; - hnm->buffer1 = av_mallocz(avctx->width * avctx->height); - hnm->buffer2 = av_mallocz(avctx->width * avctx->height); - hnm->processed = av_mallocz(avctx->width * avctx->height); + hnm->buffer1 = av_calloc(avctx->width, avctx->height); + hnm->buffer2 = av_calloc(avctx->width, avctx->height); + hnm->processed = av_calloc(avctx->width, avctx->height); if (!hnm->buffer1 || !hnm->buffer2 || !hnm->processed) { av_log(avctx, AV_LOG_ERROR, "av_mallocz() failed\n"); diff --git a/libavcodec/huffyuvenc.c b/libavcodec/huffyuvenc.c index dd3ed9a996..d9c574fb77 100644 --- a/libavcodec/huffyuvenc.c +++ b/libavcodec/huffyuvenc.c @@ -437,7 +437,7 @@ static av_cold int encode_init(AVCodecContext *avctx) s->picture_number=0; for (int i = 0; i < 3; i++) { - s->temp[i] = av_malloc(4 * avctx->width + 16); + s->temp[i] = av_malloc(4 * (size_t)avctx->width + 16); if (!s->temp[i]) return AVERROR(ENOMEM); } diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 66839c3c39..25444c4704 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -251,7 +251,7 @@ static int extract_header(AVCodecContext *const avctx, av_log(avctx, AV_LOG_ERROR, "bpp %d too large for palette\n", s->bpp); return AVERROR(ENOMEM); } - s->mask_buf = av_malloc((s->planesize * 32) + AV_INPUT_BUFFER_PADDING_SIZE); + s->mask_buf = av_malloc(s->planesize * (size_t)32 + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->mask_buf) return AVERROR(ENOMEM); s->mask_palbuf = av_malloc((2 << s->bpp) * sizeof(uint32_t) + AV_INPUT_BUFFER_PADDING_SIZE); @@ -279,7 +279,7 @@ static int extract_header(AVCodecContext *const avctx, if (avctx->codec_tag == MKTAG('P', 'B', 'M', ' ') && s->ham == 4) extra_space = 4; - s->ham_buf = av_mallocz((s->planesize * 8) + AV_INPUT_BUFFER_PADDING_SIZE); + s->ham_buf = av_mallocz(s->planesize * (size_t)8 + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->ham_buf) return AVERROR(ENOMEM); @@ -371,7 +371,7 @@ static av_cold int decode_init(AVCodecContext *avctx) if ((err = av_image_check_size(avctx->width, avctx->height, 0, avctx))) return err; s->planesize = FFALIGN(avctx->width, 16) >> 3; // Align plane size in bits to word-boundary - s->planebuf = av_malloc(s->planesize * avctx->height + AV_INPUT_BUFFER_PADDING_SIZE); + s->planebuf = av_malloc(s->planesize * (size_t)avctx->height + AV_INPUT_BUFFER_PADDING_SIZE); if (!s->planebuf) return AVERROR(ENOMEM); diff --git a/libavcodec/ivi.c b/libavcodec/ivi.c index a38f382d5f..a3fc64ba54 100644 --- a/libavcodec/ivi.c +++ b/libavcodec/ivi.c @@ -927,7 +927,7 @@ static void *prepare_buf(IVI45DecContext *ctx, IVIBandDesc *band, int i) if (ctx->pic_conf.luma_bands <= 1 && i == 2) return NULL; if (!band->bufs[i]) - band->bufs[i] = av_mallocz(2 * band->bufsize); + band->bufs[i] = av_calloc(band->bufsize, 2); return band->bufs[i]; } diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 369377e4fc..4827def0a9 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -330,7 +330,7 @@ static int get_siz(Jpeg2000DecoderContext *s) for (i = 0; i < s->numXtiles * s->numYtiles; i++) { Jpeg2000Tile *tile = s->tile + i; - tile->comp = av_mallocz(s->ncomponents * sizeof(*tile->comp)); + tile->comp = av_calloc(s->ncomponents, sizeof(*tile->comp)); if (!tile->comp) return AVERROR(ENOMEM); } diff --git a/libavcodec/kgv1dec.c b/libavcodec/kgv1dec.c index bdc5a16259..9422f6f5ed 100644 --- a/libavcodec/kgv1dec.c +++ b/libavcodec/kgv1dec.c @@ -74,8 +74,8 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame, } if (!c->frame_buffer) { - c->frame_buffer = av_mallocz(avctx->width * avctx->height * 2); - c->last_frame_buffer = av_mallocz(avctx->width * avctx->height * 2); + c->frame_buffer = av_calloc(avctx->width * (size_t)avctx->height, 2); + c->last_frame_buffer = av_calloc(avctx->width * (size_t)avctx->height, 2); if (!c->frame_buffer || !c->last_frame_buffer) { decode_flush(avctx); return AVERROR(ENOMEM); diff --git a/libavcodec/magicyuvenc.c b/libavcodec/magicyuvenc.c index 80a54638bc..15d3058ea6 100644 --- a/libavcodec/magicyuvenc.c +++ b/libavcodec/magicyuvenc.c @@ -231,7 +231,7 @@ static av_cold int magy_encode_init(AVCodecContext *avctx) sl->height = AV_CEIL_RSHIFT(sl->height, s->vshift[i]); sl->width = AV_CEIL_RSHIFT(avctx->width, s->hshift[i]); - sl->slice = av_malloc(avctx->width * (s->slice_height + 2) + + sl->slice = av_malloc((size_t)avctx->width * (s->slice_height + 2) + AV_INPUT_BUFFER_PADDING_SIZE); if (!sl->slice) return AVERROR(ENOMEM); diff --git a/libavcodec/mss2.c b/libavcodec/mss2.c index aaeceb055d..36009f5782 100644 --- a/libavcodec/mss2.c +++ b/libavcodec/mss2.c @@ -884,8 +884,8 @@ static av_cold int mss2_decode_init(AVCodecContext *avctx) return ret; ctx->last_pic = av_frame_alloc(); c->pal_stride = c->mask_stride; - c->pal_pic = av_mallocz(c->pal_stride * avctx->height); - c->last_pal_pic = av_mallocz(c->pal_stride * avctx->height); + c->pal_pic = av_calloc(c->pal_stride, avctx->height); + c->last_pal_pic = av_calloc(c->pal_stride, avctx->height); if (!c->pal_pic || !c->last_pal_pic || !ctx->last_pic) return AVERROR(ENOMEM); if (ret = wmv9_init(avctx)) diff --git a/libavcodec/msvideo1enc.c b/libavcodec/msvideo1enc.c index b1cae72081..86b373b0f5 100644 --- a/libavcodec/msvideo1enc.c +++ b/libavcodec/msvideo1enc.c @@ -84,7 +84,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt, dst= buf= pkt->data; if(!c->prev) - c->prev = av_malloc(avctx->width * 3 * (avctx->height + 3)); + c->prev = av_malloc_array(avctx->width * (size_t)3, avctx->height + 3); if (!c->prev) return AVERROR(ENOMEM); prevptr = c->prev + avctx->width * 3 * (FFALIGN(avctx->height, 4) - 1); diff --git a/libavcodec/nvenc.c b/libavcodec/nvenc.c index dffbb67652..0c41846a26 100644 --- a/libavcodec/nvenc.c +++ b/libavcodec/nvenc.c @@ -405,7 +405,7 @@ static int nvenc_check_codec_support(AVCodecContext *avctx) if (ret != NV_ENC_SUCCESS || !count) return AVERROR(ENOSYS); - guids = av_malloc(count * sizeof(GUID)); + guids = av_malloc_array(count, sizeof(GUID)); if (!guids) return AVERROR(ENOMEM); diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c index d48ede909c..f61a2de874 100644 --- a/libavcodec/ratecontrol.c +++ b/libavcodec/ratecontrol.c @@ -577,7 +577,7 @@ av_cold int ff_rate_control_init(MPVMainEncContext *const m) i += m->max_b_frames; if (i <= 0 || i >= INT_MAX / sizeof(RateControlEntry)) return -1; - rcc->entry = av_mallocz(i * sizeof(RateControlEntry)); + rcc->entry = av_calloc(i, sizeof(RateControlEntry)); if (!rcc->entry) return AVERROR(ENOMEM); rcc->num_entries = i; diff --git a/libavcodec/rl2.c b/libavcodec/rl2.c index e427a27dce..e15750b370 100644 --- a/libavcodec/rl2.c +++ b/libavcodec/rl2.c @@ -184,7 +184,7 @@ static av_cold int rl2_decode_init(AVCodecContext *avctx) if (back_size > 0) { /* The 254 are padding to ensure that pointer arithmetic stays within * the buffer. */ - uint8_t *back_frame = av_mallocz(avctx->width * avctx->height + 254); + uint8_t *back_frame = av_mallocz(avctx->width * (size_t)avctx->height + 254); if (!back_frame) return AVERROR(ENOMEM); rl2_rle_decode(s, avctx->extradata + EXTRADATA1_SIZE, back_size, diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index dd5ee05eba..bde0eedc4d 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1403,15 +1403,15 @@ static int rv34_decoder_alloc(RV34DecContext *r) { r->intra_types_stride = r->s.mb_width * 4 + 4; - r->cbp_chroma = av_mallocz(r->s.mb_stride * r->s.mb_height * + r->cbp_chroma = av_calloc((size_t)r->s.mb_stride * r->s.mb_height, sizeof(*r->cbp_chroma)); - r->cbp_luma = av_mallocz(r->s.mb_stride * r->s.mb_height * + r->cbp_luma = av_calloc((size_t)r->s.mb_stride * r->s.mb_height, sizeof(*r->cbp_luma)); - r->deblock_coefs = av_mallocz(r->s.mb_stride * r->s.mb_height * + r->deblock_coefs = av_calloc((size_t)r->s.mb_stride * r->s.mb_height, sizeof(*r->deblock_coefs)); - r->intra_types_hist = av_malloc(r->intra_types_stride * 4 * 2 * + r->intra_types_hist = av_malloc_array((size_t)r->intra_types_stride * 4 * 2, sizeof(*r->intra_types_hist)); - r->mb_type = av_mallocz(r->s.mb_stride * r->s.mb_height * + r->mb_type = av_calloc((size_t)r->s.mb_stride * r->s.mb_height, sizeof(*r->mb_type)); if (!(r->cbp_chroma && r->cbp_luma && r->deblock_coefs && @@ -1721,7 +1721,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, AVFrame *pict, if (!r->tmp_b_block_base) { int i; - r->tmp_b_block_base = av_malloc(s->linesize * 48); + r->tmp_b_block_base = av_malloc_array(s->linesize, 48); if (!r->tmp_b_block_base) return AVERROR(ENOMEM); for (i = 0; i < 2; i++) diff --git a/libavcodec/sgienc.c b/libavcodec/sgienc.c index a6ec443970..c27a97eaa2 100644 --- a/libavcodec/sgienc.c +++ b/libavcodec/sgienc.c @@ -201,7 +201,7 @@ static int encode_frame(AVCodecContext *avctx, AVPacket *pkt, bytestream2_skip_p(&pbc, tablesize); /* Make an intermediate consecutive buffer. */ - if (!(encode_buf = av_malloc(width * bytes_per_channel))) + if (!(encode_buf = av_malloc_array(width, bytes_per_channel))) return AVERROR(ENOMEM); for (z = 0; z < depth; z++) { diff --git a/libavcodec/svq1enc.c b/libavcodec/svq1enc.c index 4855bed188..c2224a4bb9 100644 --- a/libavcodec/svq1enc.c +++ b/libavcodec/svq1enc.c @@ -605,12 +605,12 @@ static av_cold int svq1_encode_init(AVCodecContext *avctx) s->m.c.picture_structure = PICT_FRAME; s->m.me.temp = - s->m.me.scratchpad = av_mallocz((avctx->width + 64) * - 2 * 16 * 2 * sizeof(uint8_t)); - s->mb_type = av_mallocz((s->y_block_width + 1) * - s->y_block_height * sizeof(int16_t)); - s->dummy = av_mallocz((s->y_block_width + 1) * - s->y_block_height * sizeof(int32_t)); + s->m.me.scratchpad = av_calloc((size_t)(avctx->width + 64) * + 2 * 16 * 2, sizeof(uint8_t)); + s->mb_type = av_calloc((size_t)(s->y_block_width + 1) * + s->y_block_height, sizeof(int16_t)); + s->dummy = av_calloc((size_t)(s->y_block_width + 1) * + s->y_block_height, sizeof(int32_t)); s->m.new_pic = av_frame_alloc(); if (!s->m.me.scratchpad || diff --git a/libavcodec/svq3.c b/libavcodec/svq3.c index 296e81f322..03b2bcf43e 100644 --- a/libavcodec/svq3.c +++ b/libavcodec/svq3.c @@ -1332,11 +1332,11 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx) } } - s->intra4x4_pred_mode = av_mallocz(s->mb_stride * 2 * 8); + s->intra4x4_pred_mode = av_calloc((size_t)s->mb_stride * 2, 8); if (!s->intra4x4_pred_mode) return AVERROR(ENOMEM); - s->mb2br_xy = av_mallocz(s->mb_stride * (s->mb_height + 1) * + s->mb2br_xy = av_calloc((size_t)s->mb_stride * (s->mb_height + 1), sizeof(*s->mb2br_xy)); if (!s->mb2br_xy) return AVERROR(ENOMEM); diff --git a/libavcodec/tiff.c b/libavcodec/tiff.c index 8a179f0fd0..bd7c17e77f 100644 --- a/libavcodec/tiff.c +++ b/libavcodec/tiff.c @@ -2202,7 +2202,7 @@ again: s->avctx->pix_fmt == AV_PIX_FMT_RGBA) { stride = stride * 5 / 4; five_planes = - dst = av_malloc(stride * s->height); + dst = av_malloc_array(stride, s->height); if (!dst) return AVERROR(ENOMEM); } diff --git a/libavcodec/tscc2.c b/libavcodec/tscc2.c index cfe5a6e752..0797ae2647 100644 --- a/libavcodec/tscc2.c +++ b/libavcodec/tscc2.c @@ -342,7 +342,7 @@ static av_cold int tscc2_decode_init(AVCodecContext *avctx) c->mb_width = FFALIGN(avctx->width, 16) >> 4; c->mb_height = FFALIGN(avctx->height, 8) >> 3; - c->slice_quants = av_malloc(c->mb_width * c->mb_height); + c->slice_quants = av_malloc_array(c->mb_width, c->mb_height); if (!c->slice_quants) { av_log(avctx, AV_LOG_ERROR, "Cannot allocate slice information\n"); return AVERROR(ENOMEM); diff --git a/libavcodec/utvideoenc.c b/libavcodec/utvideoenc.c index 7cefca79bc..4dc95a79aa 100644 --- a/libavcodec/utvideoenc.c +++ b/libavcodec/utvideoenc.c @@ -187,7 +187,7 @@ static av_cold int utvideo_encode_init(AVCodecContext *avctx) } for (i = 0; i < c->planes; i++) { - c->slice_buffer[i] = av_malloc(c->slice_stride * (avctx->height + 2) + + c->slice_buffer[i] = av_malloc(c->slice_stride * (size_t)(avctx->height + 2) + AV_INPUT_BUFFER_PADDING_SIZE); if (!c->slice_buffer[i]) { av_log(avctx, AV_LOG_ERROR, "Cannot allocate temporary buffer 1.\n"); diff --git a/libavcodec/v4l2_context.c b/libavcodec/v4l2_context.c index be1df3785b..7b0387ab65 100644 --- a/libavcodec/v4l2_context.c +++ b/libavcodec/v4l2_context.c @@ -736,7 +736,7 @@ int ff_v4l2_context_init(V4L2Context* ctx) } ctx->num_buffers = req.count; - ctx->buffers = av_mallocz(ctx->num_buffers * sizeof(V4L2Buffer)); + ctx->buffers = av_calloc(ctx->num_buffers, sizeof(V4L2Buffer)); if (!ctx->buffers) { av_log(logger(ctx), AV_LOG_ERROR, "%s malloc enomem\n", ctx->name); return AVERROR(ENOMEM); diff --git a/libavcodec/vb.c b/libavcodec/vb.c index bd5f786bd1..3fc7eb5252 100644 --- a/libavcodec/vb.c +++ b/libavcodec/vb.c @@ -258,8 +258,8 @@ static av_cold int decode_init(AVCodecContext *avctx) c->avctx = avctx; avctx->pix_fmt = AV_PIX_FMT_PAL8; - c->frame = av_mallocz(avctx->width * avctx->height); - c->prev_frame = av_mallocz(avctx->width * avctx->height); + c->frame = av_calloc(avctx->width, avctx->height); + c->prev_frame = av_calloc(avctx->width, avctx->height); if (!c->frame || !c->prev_frame) return AVERROR(ENOMEM); diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index 1102e8123e..8a14a6bc2c 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -363,52 +363,52 @@ static av_cold int vc1_decode_init_alloc_tables(VC1Context *v) int mb_height = FFALIGN(s->mb_height, 2); /* Allocate mb bitplanes */ - v->mv_type_mb_plane = av_malloc (s->mb_stride * mb_height); - v->direct_mb_plane = av_malloc (s->mb_stride * mb_height); - v->forward_mb_plane = av_malloc (s->mb_stride * mb_height); - v->fieldtx_plane = av_mallocz(s->mb_stride * mb_height); - v->acpred_plane = av_malloc (s->mb_stride * mb_height); - v->over_flags_plane = av_malloc (s->mb_stride * mb_height); + v->mv_type_mb_plane = av_malloc_array (s->mb_stride, mb_height); + v->direct_mb_plane = av_malloc_array (s->mb_stride, mb_height); + v->forward_mb_plane = av_malloc_array (s->mb_stride, mb_height); + v->fieldtx_plane = av_calloc(s->mb_stride, mb_height); + v->acpred_plane = av_malloc_array (s->mb_stride, mb_height); + v->over_flags_plane = av_malloc_array (s->mb_stride, mb_height); if (!v->mv_type_mb_plane || !v->direct_mb_plane || !v->forward_mb_plane || !v->fieldtx_plane || !v->acpred_plane || !v->over_flags_plane) return AVERROR(ENOMEM); v->n_allocated_blks = s->mb_width + 2; - v->block = av_malloc(sizeof(*v->block) * v->n_allocated_blks); - v->cbp_base = av_malloc(sizeof(v->cbp_base[0]) * 3 * s->mb_stride); + v->block = av_malloc_array(v->n_allocated_blks, sizeof(*v->block)); + v->cbp_base = av_malloc_array(3 * s->mb_stride, sizeof(v->cbp_base[0])); if (!v->block || !v->cbp_base) return AVERROR(ENOMEM); v->cbp = v->cbp_base + 2 * s->mb_stride; - v->ttblk_base = av_mallocz(sizeof(v->ttblk_base[0]) * 3 * s->mb_stride); + v->ttblk_base = av_calloc(3 * s->mb_stride, sizeof(v->ttblk_base[0])); if (!v->ttblk_base) return AVERROR(ENOMEM); v->ttblk = v->ttblk_base + 2 * s->mb_stride; - v->is_intra_base = av_mallocz(sizeof(v->is_intra_base[0]) * 3 * s->mb_stride); + v->is_intra_base = av_calloc(3 * s->mb_stride, sizeof(v->is_intra_base[0])); if (!v->is_intra_base) return AVERROR(ENOMEM); v->is_intra = v->is_intra_base + 2 * s->mb_stride; - v->luma_mv_base = av_mallocz(sizeof(v->luma_mv_base[0]) * 3 * s->mb_stride); + v->luma_mv_base = av_calloc(3 * s->mb_stride, sizeof(v->luma_mv_base[0])); if (!v->luma_mv_base) return AVERROR(ENOMEM); v->luma_mv = v->luma_mv_base + 2 * s->mb_stride; /* allocate block type info in that way so it could be used with s->block_index[] */ - v->mb_type_base = av_mallocz(s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2); + v->mb_type_base = av_mallocz(s->b8_stride * (size_t)(mb_height * 2 + 1) + s->mb_stride * (size_t)(mb_height + 1) * 2); if (!v->mb_type_base) return AVERROR(ENOMEM); v->mb_type = v->mb_type_base + s->b8_stride + 1; /* allocate memory to store block level MV info */ - v->blk_mv_type_base = av_mallocz( s->b8_stride * (mb_height * 2 + 1)); + v->blk_mv_type_base = av_calloc(s->b8_stride, mb_height * 2 + 1); if (!v->blk_mv_type_base) return AVERROR(ENOMEM); v->blk_mv_type = v->blk_mv_type_base + s->b8_stride + 1; - v->mv_f_base = av_mallocz(2 * (s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2)); + v->mv_f_base = av_mallocz(2 * (s->b8_stride * (size_t)(mb_height * 2 + 1) + s->mb_stride * (size_t)(mb_height + 1) * 2)); if (!v->mv_f_base) return AVERROR(ENOMEM); v->mv_f[0] = v->mv_f_base + s->b8_stride + 1; v->mv_f[1] = v->mv_f[0] + (s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2); - v->mv_f_next_base = av_mallocz(2 * (s->b8_stride * (mb_height * 2 + 1) + s->mb_stride * (mb_height + 1) * 2)); + v->mv_f_next_base = av_mallocz(2 * (s->b8_stride * (size_t)(mb_height * 2 + 1) + s->mb_stride * (size_t)(mb_height + 1) * 2)); if (!v->mv_f_next_base) return AVERROR(ENOMEM); v->mv_f_next[0] = v->mv_f_next_base + s->b8_stride + 1; diff --git a/libavcodec/vc2enc.c b/libavcodec/vc2enc.c index 2c155c01a1..f761d173cc 100644 --- a/libavcodec/vc2enc.c +++ b/libavcodec/vc2enc.c @@ -1144,7 +1144,7 @@ static av_cold int vc2_encode_init(AVCodecContext *avctx) p->dwt_width = w = FFALIGN(p->width, (1 << s->wavelet_depth)); p->dwt_height = h = FFALIGN(p->height, (1 << s->wavelet_depth)); p->coef_stride = FFALIGN(p->dwt_width, 32); - p->coef_buf = av_mallocz(p->coef_stride*p->dwt_height*sizeof(dwtcoef)); + p->coef_buf = av_calloc(p->coef_stride * (size_t)p->dwt_height, sizeof(dwtcoef)); if (!p->coef_buf) return AVERROR(ENOMEM); for (level = s->wavelet_depth-1; level >= 0; level--) { diff --git a/libavcodec/vorbisdec.c b/libavcodec/vorbisdec.c index aeea1b4908..d8998e077c 100644 --- a/libavcodec/vorbisdec.c +++ b/libavcodec/vorbisdec.c @@ -254,10 +254,10 @@ static int vorbis_parse_setup_hdr_codebooks(vorbis_context *vc) ff_dlog(NULL, " Codebooks: %d \n", vc->codebook_count); - vc->codebooks = av_mallocz(vc->codebook_count * sizeof(*vc->codebooks)); - tmp_vlc_bits = av_mallocz(V_MAX_VLCS * sizeof(*tmp_vlc_bits)); - tmp_vlc_codes = av_mallocz(V_MAX_VLCS * sizeof(*tmp_vlc_codes)); - codebook_multiplicands = av_malloc(V_MAX_VLCS * sizeof(*codebook_multiplicands)); + vc->codebooks = av_calloc(vc->codebook_count, sizeof(*vc->codebooks)); + tmp_vlc_bits = av_calloc(V_MAX_VLCS, sizeof(*tmp_vlc_bits)); + tmp_vlc_codes = av_calloc(V_MAX_VLCS, sizeof(*tmp_vlc_codes)); + codebook_multiplicands = av_malloc_array(V_MAX_VLCS, sizeof(*codebook_multiplicands)); if (!vc->codebooks || !tmp_vlc_bits || !tmp_vlc_codes || !codebook_multiplicands) { ret = AVERROR(ENOMEM); @@ -513,7 +513,7 @@ static int vorbis_parse_setup_hdr_floors(vorbis_context *vc) vc->floor_count = get_bits(gb, 6) + 1; - vc->floors = av_mallocz(vc->floor_count * sizeof(*vc->floors)); + vc->floors = av_calloc(vc->floor_count, sizeof(*vc->floors)); if (!vc->floors) return AVERROR(ENOMEM); @@ -702,7 +702,7 @@ static int vorbis_parse_setup_hdr_residues(vorbis_context *vc) unsigned i, j, k; vc->residue_count = get_bits(gb, 6)+1; - vc->residues = av_mallocz(vc->residue_count * sizeof(*vc->residues)); + vc->residues = av_calloc(vc->residue_count, sizeof(*vc->residues)); if (!vc->residues) return AVERROR(ENOMEM); @@ -783,7 +783,7 @@ static int vorbis_parse_setup_hdr_mappings(vorbis_context *vc) unsigned i, j; vc->mapping_count = get_bits(gb, 6)+1; - vc->mappings = av_mallocz(vc->mapping_count * sizeof(*vc->mappings)); + vc->mappings = av_calloc(vc->mapping_count, sizeof(*vc->mappings)); if (!vc->mappings) return AVERROR(ENOMEM); @@ -809,9 +809,9 @@ static int vorbis_parse_setup_hdr_mappings(vorbis_context *vc) "Square polar channel mapping with less than two channels is not compliant with the Vorbis I specification.\n"); return AVERROR_INVALIDDATA; } - mapping_setup->magnitude = av_mallocz(mapping_setup->coupling_steps * + mapping_setup->magnitude = av_calloc(mapping_setup->coupling_steps, sizeof(*mapping_setup->magnitude)); - mapping_setup->angle = av_mallocz(mapping_setup->coupling_steps * + mapping_setup->angle = av_calloc(mapping_setup->coupling_steps, sizeof(*mapping_setup->angle)); if (!mapping_setup->angle || !mapping_setup->magnitude) return AVERROR(ENOMEM); diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 39cc00fefe..b21eeff7c5 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -227,15 +227,15 @@ int update_dimensions(VP8Context *s, int width, int height, int is_vp7) s->mb_layout = is_vp7 || avctx->active_thread_type == FF_THREAD_SLICE && avctx->thread_count > 1; if (!s->mb_layout) { // Frame threading and one thread - s->macroblocks_base = av_mallocz((s->mb_width + s->mb_height * 2 + 1) * + s->macroblocks_base = av_calloc(s->mb_width + (size_t)s->mb_height * 2 + 1, sizeof(*s->macroblocks)); - s->intra4x4_pred_mode_top = av_mallocz(s->mb_width * 4); + s->intra4x4_pred_mode_top = av_calloc(s->mb_width, 4); } else // Sliced threading - s->macroblocks_base = av_mallocz((s->mb_width + 2) * (s->mb_height + 2) * + s->macroblocks_base = av_calloc((s->mb_width + 2) * (size_t)(s->mb_height + 2), sizeof(*s->macroblocks)); - s->top_nnz = av_mallocz(s->mb_width * sizeof(*s->top_nnz)); - s->top_border = av_mallocz((s->mb_width + 1) * sizeof(*s->top_border)); - s->thread_data = av_mallocz(MAX_THREADS * sizeof(VP8ThreadData)); + s->top_nnz = av_calloc(s->mb_width, sizeof(*s->top_nnz)); + s->top_border = av_calloc(s->mb_width + 1, sizeof(*s->top_border)); + s->thread_data = av_calloc(MAX_THREADS, sizeof(VP8ThreadData)); if (!s->macroblocks_base || !s->top_nnz || !s->top_border || !s->thread_data || (!s->intra4x4_pred_mode_top && !s->mb_layout)) { @@ -245,7 +245,7 @@ int update_dimensions(VP8Context *s, int width, int height, int is_vp7) for (i = 0; i < MAX_THREADS; i++) { s->thread_data[i].filter_strength = - av_mallocz(s->mb_width * sizeof(*s->thread_data[0].filter_strength)); + av_calloc(s->mb_width, sizeof(*s->thread_data[0].filter_strength)); if (!s->thread_data[i].filter_strength) { free_buffers(s); return AVERROR(ENOMEM); diff --git a/libavcodec/vqcdec.c b/libavcodec/vqcdec.c index bb69844327..6f9c5c2867 100644 --- a/libavcodec/vqcdec.c +++ b/libavcodec/vqcdec.c @@ -76,7 +76,7 @@ static av_cold int vqc_decode_init(AVCodecContext * avctx) if (avctx->width & 15) return AVERROR_PATCHWELCOME; - s->vectors = av_malloc((avctx->width * avctx->height * 3) / 2); + s->vectors = av_malloc_array(avctx->width, avctx->height * 3 / 2); if (!s->vectors) return AVERROR(ENOMEM); diff --git a/libavcodec/xsubdec.c b/libavcodec/xsubdec.c index 6be4c18b0b..61d9f27547 100644 --- a/libavcodec/xsubdec.c +++ b/libavcodec/xsubdec.c @@ -117,7 +117,7 @@ static int decode_frame(AVCodecContext *avctx, AVSubtitle *sub, rect->w = w; rect->h = h; rect->type = SUBTITLE_BITMAP; rect->linesize[0] = w; - rect->data[0] = av_malloc(w * h); + rect->data[0] = av_malloc_array(w, h); rect->nb_colors = 4; rect->data[1] = av_mallocz(AVPALETTE_SIZE); if (!rect->data[0] || !rect->data[1]) diff --git a/libavformat/dashenc.c b/libavformat/dashenc.c index 406ee2cf0d..1a43726b82 100644 --- a/libavformat/dashenc.c +++ b/libavformat/dashenc.c @@ -1354,7 +1354,7 @@ static int dash_init(AVFormatContext *s) if (ptr) *ptr = '\0'; - c->streams = av_mallocz(sizeof(*c->streams) * s->nb_streams); + c->streams = av_calloc(s->nb_streams, sizeof(*c->streams)); if (!c->streams) return AVERROR(ENOMEM); diff --git a/libavformat/demux.c b/libavformat/demux.c index 193fd17739..68d593edb3 100644 --- a/libavformat/demux.c +++ b/libavformat/demux.c @@ -2345,7 +2345,7 @@ int ff_rfps_add_frame(AVFormatContext *ic, AVStream *st, int64_t ts) int64_t duration = ts - last; if (!info->duration_error) - info->duration_error = av_mallocz(sizeof(info->duration_error[0])*2); + info->duration_error = av_calloc(2, sizeof(info->duration_error[0])); if (!info->duration_error) return AVERROR(ENOMEM); diff --git a/libavformat/flvdec.c b/libavformat/flvdec.c index 03310503d1..5c60fc24f5 100644 --- a/libavformat/flvdec.c +++ b/libavformat/flvdec.c @@ -568,7 +568,7 @@ static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, int64_t m // metadata for indexing break; - if (!(*current_array = av_mallocz(sizeof(**current_array) * arraylen))) { + if (!(*current_array = av_calloc(arraylen, sizeof(**current_array)))) { ret = AVERROR(ENOMEM); goto finish; } diff --git a/libavformat/hlsenc.c b/libavformat/hlsenc.c index 0b69ae4b3b..250be87e39 100644 --- a/libavformat/hlsenc.c +++ b/libavformat/hlsenc.c @@ -2030,7 +2030,7 @@ static int parse_variant_stream_mapstring(AVFormatContext *s) } av_freep(&p); - hls->var_streams = av_mallocz(sizeof(*hls->var_streams) * nb_varstreams); + hls->var_streams = av_calloc(nb_varstreams, sizeof(*hls->var_streams)); if (!hls->var_streams) return AVERROR(ENOMEM); hls->nb_varstreams = nb_varstreams; @@ -2058,7 +2058,7 @@ static int parse_variant_stream_mapstring(AVFormatContext *s) break; q++; } - vs->streams = av_mallocz(sizeof(AVStream *) * vs->nb_streams); + vs->streams = av_calloc(vs->nb_streams, sizeof(AVStream *)); if (!vs->streams) return AVERROR(ENOMEM); @@ -2160,7 +2160,7 @@ static int parse_cc_stream_mapstring(AVFormatContext *s) } av_freep(&p); - hls->cc_streams = av_mallocz(sizeof(*hls->cc_streams) * nb_ccstreams); + hls->cc_streams = av_calloc(nb_ccstreams, sizeof(*hls->cc_streams)); if (!hls->cc_streams) return AVERROR(ENOMEM); hls->nb_ccstreams = nb_ccstreams; @@ -2240,8 +2240,8 @@ static int update_variant_stream_info(AVFormatContext *s) hls->var_streams[0].var_stream_idx = 0; hls->var_streams[0].nb_streams = s->nb_streams; - hls->var_streams[0].streams = av_mallocz(sizeof(AVStream *) * - hls->var_streams[0].nb_streams); + hls->var_streams[0].streams = av_calloc(hls->var_streams[0].nb_streams, + sizeof(AVStream *)); if (!hls->var_streams[0].streams) return AVERROR(ENOMEM); diff --git a/libavformat/jvdec.c b/libavformat/jvdec.c index 456a8c52e9..08aa8e12ad 100644 --- a/libavformat/jvdec.c +++ b/libavformat/jvdec.c @@ -110,12 +110,12 @@ static int read_header(AVFormatContext *s) avio_skip(pb, 10); - asti->index_entries = av_malloc(asti->nb_index_entries * + asti->index_entries = av_malloc_array(asti->nb_index_entries, sizeof(*asti->index_entries)); if (!asti->index_entries) return AVERROR(ENOMEM); - jv->frames = av_malloc(asti->nb_index_entries * sizeof(*jv->frames)); + jv->frames = av_malloc_array(asti->nb_index_entries, sizeof(*jv->frames)); if (!jv->frames) return AVERROR(ENOMEM); offset = 0x68 + asti->nb_index_entries * 16; diff --git a/libavformat/mov.c b/libavformat/mov.c index bd5f456032..c09bf55235 100644 --- a/libavformat/mov.c +++ b/libavformat/mov.c @@ -675,7 +675,7 @@ static int mov_read_dref(MOVContext *c, AVIOContext *pb, MOVAtom atom) } av_free(sc->drefs); sc->drefs_count = 0; - sc->drefs = av_mallocz(entries * sizeof(*sc->drefs)); + sc->drefs = av_calloc(entries, sizeof(*sc->drefs)); if (!sc->drefs) return AVERROR(ENOMEM); sc->drefs_count = entries; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]