ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-19 21:06:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

avutil/mem: Handle fast allocations near UINT_MAX properly

Browse Source 
av_fast_realloc and av_fast_mallocz? store the size of
the objects they allocate in an unsigned. Yet they overallocate
and currently they can allocate more than UINT_MAX bytes
in case a user has requested a size of about UINT_MAX * 16 / 17
or more if SIZE_MAX > UINT_MAX (and if the user increased
max_alloc_size via av_max_alloc). In this case it is impossible
to store the true size of the buffer via the unsigned*;
future requests are likely to use the (re)allocation codepath
even if the buffer is actually large enough because of
the incorrect size.

Fix this by ensuring that the actually allocated size
always fits into an unsigned. (This entails erroring out
in case the user requested more than UINT_MAX.)

Reviewed-by: Tomas Härdin <tjoppen@acc.umu.se>
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
This commit is contained in:
Andreas Rheinhardt 2022-07-05 21:31:19 +02:00
parent 42518d8dd0
commit aca09ed7d4
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavutil/mem.c
View File

@ -510,6 +510,8 @@ void *av_fast_realloc(void *ptr, unsigned int *size, size_t min_size)
return ptr;
max_size = atomic_load_explicit(&max_alloc_size, memory_order_relaxed);
/* *size is an unsigned, so the real maximum is <= UINT_MAX. */
max_size = FFMIN(max_size, UINT_MAX);
if (min_size > max_size) {
*size = 0;
@ -542,6 +544,8 @@ static inline void fast_malloc(void *ptr, unsigned int *size, size_t min_size, i
}
max_size = atomic_load_explicit(&max_alloc_size, memory_order_relaxed);
/* *size is an unsigned, so the real maximum is <= UINT_MAX. */
max_size = FFMIN(max_size, UINT_MAX);
if (min_size > max_size) {
av_freep(ptr);