Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
小白菜888
Ffmpeg
提交
bfa0f965
F
Ffmpeg
项目概览
小白菜888
/
Ffmpeg
通知
3
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
F
Ffmpeg
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
bfa0f965
编写于
10月 28, 2011
作者:
R
Ronald S. Bultje
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
vp8: fix overflow in segmentation map caching.
上级
38a4be3f
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
30 addition
and
18 deletion
+30
-18
libavcodec/vp8.c
libavcodec/vp8.c
+30
-18
未找到文件。
libavcodec/vp8.c
浏览文件 @
bfa0f965
...
...
@@ -50,7 +50,8 @@ static int vp8_alloc_frame(VP8Context *s, AVFrame *f)
int
ret
;
if
((
ret
=
ff_thread_get_buffer
(
s
->
avctx
,
f
))
<
0
)
return
ret
;
if
(
!
s
->
maps_are_invalid
&&
s
->
num_maps_to_be_freed
)
{
if
(
s
->
num_maps_to_be_freed
)
{
assert
(
!
s
->
maps_are_invalid
);
f
->
ref_index
[
0
]
=
s
->
segmentation_maps
[
--
s
->
num_maps_to_be_freed
];
}
else
if
(
!
(
f
->
ref_index
[
0
]
=
av_mallocz
(
s
->
mb_width
*
s
->
mb_height
)))
{
ff_thread_release_buffer
(
s
->
avctx
,
f
);
...
...
@@ -59,39 +60,50 @@ static int vp8_alloc_frame(VP8Context *s, AVFrame *f)
return
0
;
}
static
void
vp8_release_frame
(
VP8Context
*
s
,
AVFrame
*
f
,
int
is_clos
e
)
static
void
vp8_release_frame
(
VP8Context
*
s
,
AVFrame
*
f
,
int
prefer_delayed_free
,
int
can_direct_fre
e
)
{
if
(
!
is_close
)
{
if
(
f
->
ref_index
[
0
])
{
assert
(
s
->
num_maps_to_be_freed
<
FF_ARRAY_ELEMS
(
s
->
segmentation_maps
));
s
->
segmentation_maps
[
s
->
num_maps_to_be_freed
++
]
=
f
->
ref_index
[
0
];
if
(
f
->
ref_index
[
0
])
{
if
(
prefer_delayed_free
)
{
/* Upon a size change, we want to free the maps but other threads may still
* be using them, so queue them. Upon a seek, all threads are inactive so
* we want to cache one to prevent re-allocation in the next decoding
* iteration, but the rest we can free directly. */
int
max_queued_maps
=
can_direct_free
?
1
:
FF_ARRAY_ELEMS
(
s
->
segmentation_maps
);
if
(
s
->
num_maps_to_be_freed
<
max_queued_maps
)
{
s
->
segmentation_maps
[
s
->
num_maps_to_be_freed
++
]
=
f
->
ref_index
[
0
];
}
else
if
(
can_direct_free
)
/* vp8_decode_flush(), but our queue is full */
{
av_free
(
f
->
ref_index
[
0
]);
}
/* else: MEMLEAK (should never happen, but better that than crash) */
f
->
ref_index
[
0
]
=
NULL
;
}
else
/* vp8_decode_free() */
{
av_free
(
f
->
ref_index
[
0
]);
}
}
else
{
av_freep
(
&
f
->
ref_index
[
0
]);
}
ff_thread_release_buffer
(
s
->
avctx
,
f
);
}
static
void
vp8_decode_flush_impl
(
AVCodecContext
*
avctx
,
int
force
,
int
is_close
)
static
void
vp8_decode_flush_impl
(
AVCodecContext
*
avctx
,
int
prefer_delayed_free
,
int
can_direct_free
,
int
free_mem
)
{
VP8Context
*
s
=
avctx
->
priv_data
;
int
i
;
if
(
!
avctx
->
is_copy
||
force
)
{
if
(
!
avctx
->
is_copy
)
{
for
(
i
=
0
;
i
<
5
;
i
++
)
if
(
s
->
frames
[
i
].
data
[
0
])
vp8_release_frame
(
s
,
&
s
->
frames
[
i
],
is_clos
e
);
vp8_release_frame
(
s
,
&
s
->
frames
[
i
],
prefer_delayed_free
,
can_direct_fre
e
);
}
memset
(
s
->
framep
,
0
,
sizeof
(
s
->
framep
));
free_buffers
(
s
);
s
->
maps_are_invalid
=
1
;
if
(
free_mem
)
{
free_buffers
(
s
);
s
->
maps_are_invalid
=
1
;
}
}
static
void
vp8_decode_flush
(
AVCodecContext
*
avctx
)
{
vp8_decode_flush_impl
(
avctx
,
0
,
0
);
vp8_decode_flush_impl
(
avctx
,
1
,
1
,
0
);
}
static
int
update_dimensions
(
VP8Context
*
s
,
int
width
,
int
height
)
...
...
@@ -101,7 +113,7 @@ static int update_dimensions(VP8Context *s, int width, int height)
if
(
av_image_check_size
(
width
,
height
,
0
,
s
->
avctx
))
return
AVERROR_INVALIDDATA
;
vp8_decode_flush_impl
(
s
->
avctx
,
1
,
0
);
vp8_decode_flush_impl
(
s
->
avctx
,
1
,
0
,
1
);
avcodec_set_dimensions
(
s
->
avctx
,
width
,
height
);
}
...
...
@@ -1580,7 +1592,7 @@ static int vp8_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
&
s
->
frames
[
i
]
!=
s
->
framep
[
VP56_FRAME_PREVIOUS
]
&&
&
s
->
frames
[
i
]
!=
s
->
framep
[
VP56_FRAME_GOLDEN
]
&&
&
s
->
frames
[
i
]
!=
s
->
framep
[
VP56_FRAME_GOLDEN2
])
vp8_release_frame
(
s
,
&
s
->
frames
[
i
],
0
);
vp8_release_frame
(
s
,
&
s
->
frames
[
i
],
1
,
0
);
// find a free buffer
for
(
i
=
0
;
i
<
5
;
i
++
)
...
...
@@ -1596,7 +1608,7 @@ static int vp8_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
abort
();
}
if
(
curframe
->
data
[
0
])
ff_thread_release_buffer
(
avctx
,
curframe
);
vp8_release_frame
(
s
,
curframe
,
1
,
0
);
curframe
->
key_frame
=
s
->
keyframe
;
curframe
->
pict_type
=
s
->
keyframe
?
AV_PICTURE_TYPE_I
:
AV_PICTURE_TYPE_P
;
...
...
@@ -1777,7 +1789,7 @@ static av_cold int vp8_decode_init(AVCodecContext *avctx)
static
av_cold
int
vp8_decode_free
(
AVCodecContext
*
avctx
)
{
vp8_decode_flush_impl
(
avctx
,
0
,
1
);
vp8_decode_flush_impl
(
avctx
,
0
,
1
,
1
);
release_queued_segmaps
(
avctx
->
priv_data
,
1
);
return
0
;
}
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录