aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-01-27 02:08:22 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-01-27 02:11:19 +0100
commit362271d72fc38cd1f4b076aff9a12b1104c26760 (patch)
treee26cb8a200453bacb2780aaac37342d5fe4ff24b
parent6512405ce20379f31e28c49599a46e9aa5647e7d (diff)
downloadffmpeg-362271d72fc38cd1f4b076aff9a12b1104c26760.tar.gz
mvdec: Check the frame counter against the correct limit.
fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavformat/mvdec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c
index c58567cad4..03471f1556 100644
--- a/libavformat/mvdec.c
+++ b/libavformat/mvdec.c
@@ -372,7 +372,7 @@ static int mv_read_packet(AVFormatContext *avctx, AVPacket *pkt)
int ret;
uint64_t pos;
- if (frame < st->nb_frames) {
+ if (frame < st->nb_index_entries) {
index = &st->index_entries[frame];
pos = avio_tell(pb);
if (index->pos > pos)