diff options
| author | Tomas Härdin <tomas.hardin@codemill.se> | 2012-10-24 16:50:26 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-10-24 17:44:35 +0200 |
| commit | 187630b2449f1eae1096f81f31bab7d81bed3cf1 (patch) | |
| tree | 404bff78d652a19266d3b7ccdcd8186c7dda3729 | |
| parent | 55c77a0ca3ce703328c1f28189e7f252ba6eef49 (diff) | |
| download | ffmpeg-187630b2449f1eae1096f81f31bab7d81bed3cf1.tar.gz | |
mxfdec: Fix CID 732262
Coverity thinks ofs can end up 15, thus writing past the end of layout[]. This
is incorrect since it's always incremented by 2. Checking ofs <= 14 makes
Coverity happy and doesn't hurt.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/mxfdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 1f583b8ad6..3f6b7d9b5e 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -782,14 +782,14 @@ static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int static void mxf_read_pixel_layout(AVIOContext *pb, MXFDescriptor *descriptor) { int code, value, ofs = 0; - char layout[16] = {0}; + char layout[16] = {0}; /* not for printing, may end up not terminated on purpose */ do { code = avio_r8(pb); value = avio_r8(pb); av_dlog(NULL, "pixel layout: code %#x\n", code); - if (ofs < 16) { + if (ofs <= 14) { layout[ofs++] = code; layout[ofs++] = value; } |