diff options
| author | Mans Rullgard <mans@mansr.com> | 2011-10-08 01:51:37 +0100 |
|---|---|---|
| committer | Mans Rullgard <mans@mansr.com> | 2011-10-10 17:49:13 +0100 |
| commit | 1703013cb7f06bb6304cbf3c5fd650d8076ee295 (patch) | |
| tree | 14736edc519ed5d8a140232e8ed51354cbaf03b4 | |
| parent | 0c46e958d1fd3817b8e9fa048d0450d509c80378 (diff) | |
| download | ffmpeg-1703013cb7f06bb6304cbf3c5fd650d8076ee295.tar.gz | |
avidec: fix signed overflow in avi_sync()
Keeping byte values read from the file as unsigned is consistent
with how they are subsequently used and avoids an undefined left
shift by 24 when bit 7 is set.
Signed-off-by: Mans Rullgard <mans@mansr.com>
| -rw-r--r-- | libavformat/avidec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 81f72d336f..da92353b00 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -843,7 +843,8 @@ static int avi_sync(AVFormatContext *s, int exit_early) { AVIContext *avi = s->priv_data; AVIOContext *pb = s->pb; - int n, d[8]; + int n; + unsigned int d[8]; unsigned int size; int64_t i, sync; @@ -860,7 +861,7 @@ start_sync: n= get_stream_idx(d+2); //av_log(s, AV_LOG_DEBUG, "%X %X %X %X %X %X %X %X %"PRId64" %d %d\n", d[0], d[1], d[2], d[3], d[4], d[5], d[6], d[7], i, size, n); - if(i + (uint64_t)size > avi->fsize || d[0]<0) + if(i + (uint64_t)size > avi->fsize || d[0] > 127) continue; //parse ix## |