Fix for memory corruption in yuvdeinterlace
Andreas Bombe <[email protected]> Tue, 9 Oct 2007 13:52:14 +0200
| Newsgroups | gmane.comp.video.mjpeg.devel |
|---|---|
| Message-ID | <[email protected]> |
In initialize_memory() the buffer sizes are increased by 2 * vertical_overshot_luma / _chroma and then the allocation goes like inframe[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma); ... adding third vertical_overshot to the precomputed size, then however these pointers are used without adjusting for overshot. So I'm sure the actual intention was something like inframe[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma; and when freeing in the deconstructor free (inframe[0] - vertical_overshot_luma); I have attached a patch against the yuvdeinterlace.cc in 1.9.0rc2, should work for CVS. However in CVS I have seen an "#ifdef notnow" disabling some copies into negative offsets, this would no longer be necessary. Patched works fine for me whereas the original version unsurprisingly segfaults very early. -- Andreas Bombe <[email protected]> GPG key 0x04880A44 ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Mjpeg-developer mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mjpeg-developer
yuvdeinterlace.patch
(text/x-diff, 5 KB)
--- yuvdeinterlace.cc.orig 2007-10-09 13:46:54.000000000 +0200
+++ yuvdeinterlace.cc 2007-10-09 13:42:15.000000000 +0200
@@ -84,32 +84,32 @@
luma_size = (w * h) + 2 * vertical_overshot_luma;
chroma_size = (cw * ch) + 2 * vertical_overshot_chroma;
- inframe[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- inframe[1] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
- inframe[2] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
-
- inframe0[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- inframe0[1] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
- inframe0[2] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
-
- inframe1[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- inframe1[1] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
- inframe1[2] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
-
- inframe2[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- inframe2[1] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
- inframe2[2] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
-
- inframe3[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- inframe3[1] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
- inframe3[2] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
-
- outframe[0] = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- outframe[1] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
- outframe[2] = (uint8_t *) malloc (chroma_size + vertical_overshot_chroma);
+ inframe[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ inframe[1] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+ inframe[2] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+
+ inframe0[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ inframe0[1] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+ inframe0[2] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+
+ inframe1[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ inframe1[1] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+ inframe1[2] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+
+ inframe2[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ inframe2[1] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+ inframe2[2] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+
+ inframe3[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ inframe3[1] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+ inframe3[2] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+
+ outframe[0] = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ outframe[1] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
+ outframe[2] = (uint8_t *) malloc (chroma_size) + vertical_overshot_chroma;
- scratch = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
- mmap = (uint8_t *) malloc (luma_size + vertical_overshot_luma);
+ scratch = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
+ mmap = (uint8_t *) malloc (luma_size) + vertical_overshot_luma;
width = w;
height = h;
@@ -127,32 +127,32 @@
~deinterlacer ()
{
- free (inframe[0]);
- free (inframe[1]);
- free (inframe[2]);
-
- free (inframe0[0]);
- free (inframe0[1]);
- free (inframe0[2]);
-
- free (inframe1[0]);
- free (inframe1[1]);
- free (inframe1[2]);
-
- free (inframe2[0]);
- free (inframe2[1]);
- free (inframe2[2]);
-
- free (inframe3[0]);
- free (inframe3[1]);
- free (inframe3[2]);
-
- free (outframe[0]);
- free (outframe[1]);
- free (outframe[2]);
+ free (inframe[0] - vertical_overshot_luma);
+ free (inframe[1] - vertical_overshot_chroma);
+ free (inframe[2] - vertical_overshot_chroma);
+
+ free (inframe0[0] - vertical_overshot_luma);
+ free (inframe0[1] - vertical_overshot_chroma);
+ free (inframe0[2] - vertical_overshot_chroma);
+
+ free (inframe1[0] - vertical_overshot_luma);
+ free (inframe1[1] - vertical_overshot_chroma);
+ free (inframe1[2] - vertical_overshot_chroma);
+
+ free (inframe2[0] - vertical_overshot_luma);
+ free (inframe2[1] - vertical_overshot_chroma);
+ free (inframe2[2] - vertical_overshot_chroma);
+
+ free (inframe3[0] - vertical_overshot_luma);
+ free (inframe3[1] - vertical_overshot_chroma);
+ free (inframe3[2] - vertical_overshot_chroma);
+
+ free (outframe[0] - vertical_overshot_luma);
+ free (outframe[1] - vertical_overshot_chroma);
+ free (outframe[2] - vertical_overshot_chroma);
- free (scratch);
- free (mmap);
+ free (scratch - vertical_overshot_luma);
+ free (mmap - vertical_overshot_luma);
}