aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2021-01-31 22:42:54 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2021-10-09 22:02:20 +0200
commit64602be17d29bbcd5be61e766a8ae5a60e08bd12 (patch)
treecfe14e018cd18d6c4bdf99b3c55f1940e4eaca70
parentef75363a438b1212abeb8b3cf8d4ec451dfb199b (diff)
downloadffmpeg-64602be17d29bbcd5be61e766a8ae5a60e08bd12.tar.gz
avformat/cinedec: Fix index_entries size check
Fixes: out of array access Fixes: 29868/clusterfuzz-testcase-minimized-ffmpeg_dem_CINE_fuzzer-5692001957445632 Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavformat/cinedec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/cinedec.c b/libavformat/cinedec.c
index c615d4fc49..c067e23b35 100644
--- a/libavformat/cinedec.c
+++ b/libavformat/cinedec.c
@@ -284,7 +284,7 @@ static int cine_read_packet(AVFormatContext *avctx, AVPacket *pkt)
AVIOContext *pb = avctx->pb;
int n, size, ret;
- if (cine->pts >= st->duration)
+ if (cine->pts >= st->nb_index_entries)
return AVERROR_EOF;
avio_seek(pb, st->index_entries[cine->pts].pos, SEEK_SET);