Re: Fix for memory corruption in yuvdeinterlace

On Wed, 10 Oct 2007, Steven M. Schultz wrote:

> 	What _was_ happending was something like this:
> 
> 	    a = malloc(num) + N;
> 	    ...
> 	    free(a-N);

	Now before eveyone chimes in with "but of course that is correct"
	I'll mention that is only correct in this case

	    for (i = N; i < num - N; i++)...

	what was being done was effectively:

	    for (i = N;  i < num ; i++)

	That would, depending on the system, either work, crash, or corrupt
	the malloc area.

	There were other bugs that resulted from intermingling the concepts
	of "offset" (where to start in the buffer) with the amount to allocate.
	In some cases the offset was being subtracted out too often (bogus
	free() pointer), at other times the above error of overrunning was
	happening.

	yuvdenoise had similar problem(s) at one time - it seems to be working
	OK now though.

	If fixes are checked in I'll give it a try but over all (and NOT to
	reopen the debate) I'll just rely on the runtime deinterlacing that
	the player software I use can do - it works well enough for my needs.


	Cheers,
	Steven Schultz


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/