diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-08-21 21:30:36 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-09-05 01:01:35 +0200 |
| commit | 2858f77fd460f668a9e29dd897be940d29d9bb10 (patch) | |
| tree | d54a5fac36c7a7ad4478bb061e65b85e40ee6869 | |
| parent | fe7366ee93c8d2fc43b10dc8987cbdc7d44098fd (diff) | |
| download | ffmpeg-2858f77fd460f668a9e29dd897be940d29d9bb10.tar.gz | |
avformat/wtvdec: Check pointer before use
Fixes out of array read
Fixes: 049fdf78565f1ce5665df236d90f8657/asan_heap-oob_10a5a97_1026_42f9d4855547329560f385768de2f3fb.wtv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc5e5548df4af48674c7aef518e831b19e99f9fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/wtvdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index 71deaf0aa6..882fde13f4 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -1033,7 +1033,7 @@ static int read_header(AVFormatContext *s) while (1) { uint64_t frame_nb = avio_rl64(pb); uint64_t position = avio_rl64(pb); - while (frame_nb > e->size && e <= e_end) { + while (e <= e_end && frame_nb > e->size) { e->pos = last_position; e++; } |