diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2010-11-02 01:19:15 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2010-11-02 01:19:15 +0000 |
| commit | 7d78a964413a50409b1db441d966cd2810eb6c86 (patch) | |
| tree | 37667566719d00cf5039a27b48dcfa8671374099 | |
| parent | 742978310101b435c57e7f0adaa8ab6d345d8eb7 (diff) | |
| download | ffmpeg-7d78a964413a50409b1db441d966cd2810eb6c86.tar.gz | |
Fix possibly exploitable out of buffer writes in msrle_decode_pal4().
This fix is minimalistic, that function should be cleaned up by someone.
Originally committed as revision 25633 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/msrledec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c index 098e7d857a..97510830d5 100644 --- a/libavcodec/msrledec.c +++ b/libavcodec/msrledec.c @@ -45,7 +45,7 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic, unsigned char rle_code; unsigned char extra_byte, odd_pixel; unsigned char stream_byte; - int pixel_ptr = 0; + unsigned int pixel_ptr = 0; int row_dec = pic->linesize[0]; int row_ptr = (avctx->height - 1) * row_dec; int frame_size = row_dec * avctx->height; |