diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-17 16:56:30 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-12-24 12:20:33 +0100 |
| commit | d5551d788444872deb62101b7a52e335c87db69a (patch) | |
| tree | 89bdff4d5b3bbe9441c3b03b5975efc11b2c4d8a | |
| parent | 35f1888585e0ffa2f1334cf92fc0a16fb4a113a6 (diff) | |
| download | ffmpeg-d5551d788444872deb62101b7a52e335c87db69a.tar.gz | |
rv34: Fix potential overreads
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit b4ed3d78cb6c41c9d3ee5918c326ab925edd6a89)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit b4a1bf0bbf53cc6a736a608732b2ac1de5c2447b)
Conflicts:
libavcodec/rv34.c
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/rv34.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index a1dc799c3e..8d5f4f7e3e 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1439,6 +1439,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, slice_count = (*buf++) + 1; slices_hdr = buf + 4; buf += 8 * slice_count; + buf_size -= 1 + 8 * slice_count; }else slice_count = avctx->slice_count; @@ -1459,7 +1460,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==FF_B_TYPE) || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=FF_I_TYPE) || avctx->skip_frame >= AVDISCARD_ALL) - return buf_size; + return avpkt->size; /* skip everything if we are in a hurry>=5 */ if(avctx->hurry_up>=5) return buf_size; @@ -1511,7 +1512,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, } s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...) } - return buf_size; + return avpkt->size; } av_cold int ff_rv34_decode_end(AVCodecContext *avctx) |