Merge commit 'ac9d159015a88aa2721b271875d18482f713f354'

[ffmpeg] / libavcodec / pngdec.c

diff --git a/libavcodec/pngdec.c b/libavcodec/pngdec.c
index 436e7986b46411a457b96a90f69dd34f3d49ac38..cee97b321e92e229523c97bda718de171a001295 100644 (file)
--- a/libavcodec/pngdec.c
+++ b/libavcodec/pngdec.c
@@ -30,10 +30,6 @@
 #include "pngdsp.h"
 #include "thread.h"
 
-/* TODO:
- * - add 16 bit depth support
- */
-
 #include <zlib.h>
 
 typedef struct PNGDecContext {
@@ -60,8 +56,9 @@ typedef struct PNGDecContext {
     uint32_t palette[256];
     uint8_t *crow_buf;
     uint8_t *last_row;
-    int last_row_size;
+    unsigned int last_row_size;
     uint8_t *tmp_row;
+    unsigned int tmp_row_size;
     uint8_t *buffer;
     int buffer_size;
     int pass;
@@ -331,6 +328,7 @@ static void png_handle_row(PNGDecContext *s)
                 png_filter_row(&s->dsp, s->tmp_row, s->crow_buf[0], s->crow_buf + 1,
                                s->last_row, s->pass_row_size, s->bpp);
                 FFSWAP(uint8_t*, s->last_row, s->tmp_row);
+                FFSWAP(unsigned int, s->last_row_size, s->tmp_row_size);
                 got_line = 1;
             }
             if ((png_pass_dsp_ymask[s->pass] << (s->y & 7)) & 0x80) {
@@ -674,7 +672,7 @@ static int decode_frame(AVCodecContext *avctx,
                     goto fail;
                 if (s->interlace_type ||
                     s->color_type == PNG_COLOR_TYPE_RGB_ALPHA) {
-                    s->tmp_row = av_malloc(s->row_size);
+                    av_fast_padded_malloc(&s->tmp_row, &s->tmp_row_size, s->row_size);
                     if (!s->tmp_row)
                         goto fail;
                 }
@@ -864,7 +862,6 @@ static int decode_frame(AVCodecContext *avctx,
  the_end:
     inflateEnd(&s->zstream);
     s->crow_buf = NULL;
-    av_freep(&s->tmp_row);
     return ret;
  fail:
     av_dict_free(&metadata);
@@ -918,6 +915,8 @@ static av_cold int png_dec_end(AVCodecContext *avctx)
     s->buffer_size = 0;
     av_freep(&s->last_row);
     s->last_row_size = 0;
+    av_freep(&s->tmp_row);
+    s->tmp_row_size = 0;
 
     return 0;
 }