Skip to content
Snippets Groups Projects
Commit d5c43c21 authored by Thomas Guillem's avatar Thomas Guillem Committed by Hugo Beauzée-Luyssen
Browse files

hxxx_nal: remove useless optim


This special case is now useless since p_source is always copied to p_dest,
right after in the memmove loop.

Furthermore, this caused an invalid payload size when the buffer was actually
reallocated since the payload calculation was comparing two different buffers
offset.

CVE-2020-13428

Signed-off-by: default avatarHugo Beauzée-Luyssen <hugo@beauzee.fr>
(cherry picked from commit 56822f03d7a498bb22257d6075723c0e1c7f91fe)
Signed-off-by: default avatarHugo Beauzée-Luyssen <hugo@beauzee.fr>
parent 441907f4
No related branches found
Tags 3.1.5
No related merge requests found
...@@ -122,20 +122,6 @@ block_t *hxxx_AnnexB_to_xVC( block_t *p_block, uint8_t i_nal_length_size ) ...@@ -122,20 +122,6 @@ block_t *hxxx_AnnexB_to_xVC( block_t *p_block, uint8_t i_nal_length_size )
if( p_list[i_nalcount - 1].move != 0 || i_nal_length_size != 4 ) /* We'll need to grow or shrink */ if( p_list[i_nalcount - 1].move != 0 || i_nal_length_size != 4 ) /* We'll need to grow or shrink */
{ {
/* If we grow in size, try using realloc to avoid memcpy */
if( p_list[i_nalcount - 1].move > 0 && block_WillRealloc( p_block, 0, i_dest ) )
{
uint32_t i_sizebackup = p_block->i_buffer;
block_t *p_newblock = block_Realloc( p_block, 0, i_dest );
if( unlikely(!p_newblock) )
goto error;
p_block = p_newblock;
p_sourceend = &p_block->p_buffer[i_sizebackup];
p_source = p_dest = p_block->p_buffer;
}
else
{
block_t *p_newblock = block_Alloc( i_dest ); block_t *p_newblock = block_Alloc( i_dest );
if( unlikely(!p_newblock) ) if( unlikely(!p_newblock) )
goto error; goto error;
...@@ -146,7 +132,6 @@ block_t *hxxx_AnnexB_to_xVC( block_t *p_block, uint8_t i_nal_length_size ) ...@@ -146,7 +132,6 @@ block_t *hxxx_AnnexB_to_xVC( block_t *p_block, uint8_t i_nal_length_size )
p_block = p_newblock; p_block = p_newblock;
p_dest = p_newblock->p_buffer; p_dest = p_newblock->p_buffer;
}
} }
else else
{ {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment