aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2010-11-02 01:19:15 +0000
committerMichael Niedermayer <michaelni@gmx.at>2010-11-02 01:19:15 +0000
commit7d78a964413a50409b1db441d966cd2810eb6c86 (patch)
tree37667566719d00cf5039a27b48dcfa8671374099
parent742978310101b435c57e7f0adaa8ab6d345d8eb7 (diff)
downloadffmpeg-7d78a964413a50409b1db441d966cd2810eb6c86.tar.gz
Fix possibly exploitable out of buffer writes in msrle_decode_pal4().
This fix is minimalistic, that function should be cleaned up by someone. Originally committed as revision 25633 to svn://svn.ffmpeg.org/ffmpeg/trunk
-rw-r--r--libavcodec/msrledec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c
index 098e7d857a..97510830d5 100644
--- a/libavcodec/msrledec.c
+++ b/libavcodec/msrledec.c
@@ -45,7 +45,7 @@ static int msrle_decode_pal4(AVCodecContext *avctx, AVPicture *pic,
unsigned char rle_code;
unsigned char extra_byte, odd_pixel;
unsigned char stream_byte;
- int pixel_ptr = 0;
+ unsigned int pixel_ptr = 0;
int row_dec = pic->linesize[0];
int row_ptr = (avctx->height - 1) * row_dec;
int frame_size = row_dec * avctx->height;