Fix buffer overruns when reading extradata from the mediatype

2 files changed, 16 insertions, 5 deletions

diff --git a/decoder/LAVVideo/decoders/cuvid.cpp b/decoder/LAVVideo/decoders/cuvid.cpp
index c7c6d8f3..b6fd2d6b 100644
--- a/decoder/LAVVideo/decoders/cuvid.cpp
+++ b/decoder/LAVVideo/decoders/cuvid.cpp
@@ -630,8 +630,11 @@ STDMETHODIMP CDecCuvid::InitDecoder(AVCodecID codec, const CMediaType *pmt)
     m_AVC1Converter->SetNALUSize(mp2vi->dwFlags);
   } else {
     size_t hdr_len = 0;
-    getExtraData(*pmt, m_VideoParserExInfo.raw_seqhdr_data, &hdr_len);
-    m_VideoParserExInfo.format.seqhdr_data_length = (unsigned int)hdr_len;
+    getExtraData(*pmt, NULL, &hdr_len);
+    if (hdr_len <= 1024) {
+      getExtraData(*pmt, m_VideoParserExInfo.raw_seqhdr_data, &hdr_len);
+      m_VideoParserExInfo.format.seqhdr_data_length = (unsigned int)hdr_len;
+    }
   }
 
   m_bNeedSequenceCheck = FALSE;
diff --git a/decoder/LAVVideo/decoders/quicksync.cpp b/decoder/LAVVideo/decoders/quicksync.cpp
index e3f7a0be..80e1f587 100644
--- a/decoder/LAVVideo/decoders/quicksync.cpp
+++ b/decoder/LAVVideo/decoders/quicksync.cpp
@@ -387,9 +387,13 @@ STDMETHODIMP CDecQuickSync::InitDecoder(AVCodecID codec, const CMediaType *pmt)
     }
   }
 
-  BYTE extradata[1024] = {0};
-  size_t extralen;
-  getExtraData(*pmt, extradata, &extralen);
+  BYTE *extradata = NULL;
+  size_t extralen = 0;
+  getExtraData(*pmt, NULL, &extralen);
+  if (extralen > 0) {
+    extradata = (BYTE *)av_malloc(extralen + FF_INPUT_BUFFER_PADDING_SIZE);
+    getExtraData(*pmt, extradata, NULL);
+  }
 
   m_bNeedSequenceCheck = FALSE;
   m_bInterlaced = TRUE;
@@ -426,6 +430,10 @@ STDMETHODIMP CDecQuickSync::InitDecoder(AVCodecID codec, const CMediaType *pmt)
     m_bNeedSequenceCheck = (fourCC == FourCC_H264);
   }
 
+  // Done with the extradata
+  if (extradata)
+    av_freep(&extradata);
+
   // Configure QuickSync decoder
   CQsConfig qsConfig;
   m_pDecoder->GetConfig(&qsConfig);