diff options
| author | Clément Bœsch <ubitux@gmail.com> | 2013-01-01 16:41:37 +0100 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2013-01-01 17:23:43 +0100 |
| commit | 68e48ed72e0597ae61bc3e9e6e6d9edcb1a00073 (patch) | |
| tree | 82fefdcd290f167eb9702c66f4c629fcd06615ab | |
| parent | 97ec20a20aded201f1ef6b78559f58b984bdee39 (diff) | |
| download | ffmpeg-68e48ed72e0597ae61bc3e9e6e6d9edcb1a00073.tar.gz | |
lavc/movtextdec: keep the min size instead of max to fix overread.
Fixes Ticket #2087.
(cherry picked from commit 7d66bc7920240cc0e8df6c44b2d2cdbe4b228fbe)
| -rw-r--r-- | libavcodec/movtextdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c index a65bbb83e3..05ff53afb4 100644 --- a/libavcodec/movtextdec.c +++ b/libavcodec/movtextdec.c @@ -83,7 +83,7 @@ static int mov_text_decode_frame(AVCodecContext *avctx, * In complex cases, there are style descriptors appended to the string * so we can't just assume the packet size is the string size. */ - end = ptr + FFMAX(2 + AV_RB16(ptr), avpkt->size); + end = ptr + FFMIN(2 + AV_RB16(ptr), avpkt->size); ptr += 2; ts_start = av_rescale_q(avpkt->pts, |