[FFmpeg-cvslog] vcodec/h2645_parse: Clear buffer padding

[Michael Niedermayer]

ffmpeg | branch: release/3.1 | Michael Niedermayer <michael at niedermayer.cc> | Thu Aug 18 22:23:32 2016 +0200| [7d42daeea2df35e26dd4d45c3cce693a4d7a788c] | committer: Michael Niedermayer

vcodec/h2645_parse: Clear buffer padding

Fixes use of uninitialized memory
Fixes: 044100cb22845944988a4bd821ff8074/asan_heap-oob_329927a_1366_c3de34ce9217dac820fbb46171031bbb.jsv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 382a68b0088b06b8df20d0133d767d53d8f161ef)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d42daeea2df35e26dd4d45c3cce693a4d7a788c
---

 libavcodec/h2645_parse.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/h2645_parse.c b/libavcodec/h2645_parse.c
index d2fa5a0..50837b6 100644
--- a/libavcodec/h2645_parse.c
+++ b/libavcodec/h2645_parse.c
@@ -34,7 +34,7 @@ int ff_h2645_extract_rbsp(const uint8_t *src, int length,
 {
     int i, si, di;
     uint8_t *dst;
-    int64_t padding = small_padding ? AV_INPUT_BUFFER_PADDING_SIZE : MAX_MBPAIR_SIZE;
+    int64_t padding = small_padding ? 0 : MAX_MBPAIR_SIZE;
 
     nal->skipped_bytes = 0;
 #define STARTCODE_TEST                                                  \
@@ -90,8 +90,8 @@ int ff_h2645_extract_rbsp(const uint8_t *src, int length,
         return length;
     }
 
-    av_fast_malloc(&nal->rbsp_buffer, &nal->rbsp_buffer_size,
-                   length + padding);
+    av_fast_padded_malloc(&nal->rbsp_buffer, &nal->rbsp_buffer_size,
+                          length + padding);
     if (!nal->rbsp_buffer)
         return AVERROR(ENOMEM);