diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-10-03 16:06:23 +0200 |
|---|---|---|
| committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-12-07 16:15:02 -0500 |
| commit | 096abfa15052977eed93f0b5e01afd2d47c53c1f (patch) | |
| tree | 4bece1a3049de0b0c411a46efe22f4f1900808c4 | |
| parent | 41540b36a19d326e778268e910aff4217b20eb97 (diff) | |
| download | ffmpeg-096abfa15052977eed93f0b5e01afd2d47c53c1f.tar.gz | |
parser: fix large overreads
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
| -rw-r--r-- | libavcodec/parser.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/parser.c b/libavcodec/parser.c index 7ace766eb9..0767a34959 100644 --- a/libavcodec/parser.c +++ b/libavcodec/parser.c @@ -254,7 +254,9 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s if(!new_buffer) return AVERROR(ENOMEM); pc->buffer = new_buffer; - memcpy(&pc->buffer[pc->index], *buf, next + FF_INPUT_BUFFER_PADDING_SIZE ); + if (next > -FF_INPUT_BUFFER_PADDING_SIZE) + memcpy(&pc->buffer[pc->index], *buf, + next + FF_INPUT_BUFFER_PADDING_SIZE); pc->index = 0; *buf= pc->buffer; } |