diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-26 23:27:21 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-07 03:05:30 +0100 |
| commit | 1ecd1b4aeeb419fda0320458207991b95b4da543 (patch) | |
| tree | 5b417a029179b4cc41a71d75708856522b4345f0 | |
| parent | 04a4c4144ade592c97f82f016af85903300f2a47 (diff) | |
| download | ffmpeg-1ecd1b4aeeb419fda0320458207991b95b4da543.tar.gz | |
avcodec/g2meet: fix stride calculation, use correct format field
Fixes out of array accesses
Fixes: asan_heap-oob_ae5f63_5415_g2m4.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 83f7bd6dcf00875725c5f3b7e1bedac5a6b3c77d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/g2meet.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index 16671497d6..b342ae7262 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -490,7 +490,7 @@ static int g2m_load_cursor(AVCodecContext *avctx, G2MContext *c, cursor_hot_y = bytestream2_get_byte(gb); cursor_fmt = bytestream2_get_byte(gb); - cursor_stride = FFALIGN(cursor_w, c->cursor_fmt==1 ? 32 : 1) * 4; + cursor_stride = FFALIGN(cursor_w, cursor_fmt==1 ? 32 : 1) * 4; if (cursor_w < 1 || cursor_w > 256 || cursor_h < 1 || cursor_h > 256) { |