[FFmpeg-cvslog] avfilter/vf_fieldmatch: fix heap-buffer overflow

[Paul B Mahol]

ffmpeg | branch: release/2.8 | Paul B Mahol <onemda at gmail.com> | Sat Oct 19 11:56:02 2019 +0200| [93ad1e4a9f17ac5145c2957bb270a454c8a0cefd] | committer: Michael Niedermayer

avfilter/vf_fieldmatch: fix heap-buffer overflow

Also fix use of uninitialized values.

Fixes #8239

(cherry picked from commit ce5274c1385d55892a692998923802023526b765)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=93ad1e4a9f17ac5145c2957bb270a454c8a0cefd
---

 libavfilter/vf_fieldmatch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_fieldmatch.c b/libavfilter/vf_fieldmatch.c
index c01af6681c..1196b95e92 100644
--- a/libavfilter/vf_fieldmatch.c
+++ b/libavfilter/vf_fieldmatch.c
@@ -882,7 +882,7 @@ static int config_input(AVFilterLink *inlink)
     fm->tpitchy  = FFALIGN(w,      16);
     fm->tpitchuv = FFALIGN(w >> 1, 16);
 
-    fm->tbuffer = av_malloc(h/2 * fm->tpitchy);
+    fm->tbuffer = av_calloc((h/2 + 4) * fm->tpitchy, sizeof(*fm->tbuffer));
     fm->c_array = av_malloc((((w + fm->blockx/2)/fm->blockx)+1) *
                             (((h + fm->blocky/2)/fm->blocky)+1) *
                             4 * sizeof(*fm->c_array));