diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-28 11:35:36 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-02-28 22:10:55 +0100 |
| commit | 71a939fee47d8b59ba1258b481322d16378e556f (patch) | |
| tree | 1c48314c8e76ae91a853a4f981eff3efbbbd0a0e | |
| parent | 9dbd437da2bafbec540e38cb51bc7ce2b0101ee5 (diff) | |
| download | ffmpeg-71a939fee47d8b59ba1258b481322d16378e556f.tar.gz | |
oma: don't read beyond end of leaf_table.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 934cd18a43151ba4b819d9270d539cdb26f6e079)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavformat/omadec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/omadec.c b/libavformat/omadec.c index 0beed7165d..cc37397010 100644 --- a/libavformat/omadec.c +++ b/libavformat/omadec.c @@ -231,7 +231,7 @@ static int decrypt_init(AVFormatContext *s, ID3v2ExtraMeta *em, uint8_t *header) rprobe(s, gdata, oc->r_val) < 0 && nprobe(s, gdata, oc->n_val) < 0) { int i; - for (i = 0; i < sizeof(leaf_table); i += 2) { + for (i = 0; i < FF_ARRAY_ELEMS(leaf_table); i += 2) { uint8_t buf[16]; AV_WL64(buf, leaf_table[i]); AV_WL64(&buf[8], leaf_table[i+1]); |