diff options
| author | Matt Wolenetz <wolenetz@chromium.org> | 2016-11-21 15:54:02 -0800 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-01-26 00:34:12 +0100 |
| commit | 2481f1320a7f3073415897e4ba82c1455f0ec996 (patch) | |
| tree | ac1567fb49bccc4557bcd36d45756bd3707c7a99 | |
| parent | ceeeccc86211f072574760cd81b70726d991ad76 (diff) | |
| download | ffmpeg-2481f1320a7f3073415897e4ba82c1455f0ec996.tar.gz | |
lavf/utils.c Protect against accessing entries[nb_entries]
In ff_index_search_timestamp(), if b == num_entries,
m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is
true, then the search for the next non-discarded packet could access
entries[nb_entries], exceeding its bounds. This change adds a protection
against that scenario. Reference: https://crbug.com/666770
Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe7547d69e6721d064c8604d0a6375a2d24b35ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavformat/utils.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/utils.c b/libavformat/utils.c index 1df0ec0faa..55f23bab29 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1980,7 +1980,7 @@ int ff_index_search_timestamp(const AVIndexEntry *entries, int nb_entries, m = (a + b) >> 1; // Search for the next non-discarded packet. - while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) { + while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m < nb_entries - 1) { m++; if (m == b && entries[m].timestamp >= wanted_timestamp) { m = b - 1; |