diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-08-21 21:30:36 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-08-25 03:29:36 +0200 |
| commit | 596513ca2ce9f140135a75647cf34ea86c8d86ce (patch) | |
| tree | f63172c675edf5461c22e539bb7d32f130bd860e | |
| parent | 2f07937926e52e328ade0aeb40f61d994b41ed9d (diff) | |
| download | ffmpeg-596513ca2ce9f140135a75647cf34ea86c8d86ce.tar.gz | |
avformat/wtvdec: Check pointer before use
Fixes out of array read
Fixes: 049fdf78565f1ce5665df236d90f8657/asan_heap-oob_10a5a97_1026_42f9d4855547329560f385768de2f3fb.wtv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit cc5e5548df4af48674c7aef518e831b19e99f9fc)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/wtvdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index bd32d70dcf..3ac4501306 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -1031,7 +1031,7 @@ static int read_header(AVFormatContext *s) while (1) { uint64_t frame_nb = avio_rl64(pb); uint64_t position = avio_rl64(pb); - while (frame_nb > e->size && e <= e_end) { + while (e <= e_end && frame_nb > e->size) { e->pos = last_position; e++; } |