aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2017-10-09 11:49:28 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2017-10-13 13:02:23 +0200
commitf052d1df3e598a5d7f11edb257d1ce88160db6f1 (patch)
tree6e33df7ee8065cbe7b8748f10c1397bc382a5eb9
parent11f5a1319646d25308524e6278aee9beadff4e8c (diff)
downloadffmpeg-f052d1df3e598a5d7f11edb257d1ce88160db6f1.tar.gz
avcodec/ffv1dec: Fix out of array read in slice counting
Fixes: test-201710.mp4 Found-by: 连一汉 <lianyihan@360.cn> and Zhibin Hu Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c20f4fcb74da2d0432c7b54499bb98f48236b904) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavcodec/ffv1dec.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c
index b277c478cb..1d8c4d4cf6 100644
--- a/libavcodec/ffv1dec.c
+++ b/libavcodec/ffv1dec.c
@@ -684,7 +684,7 @@ static int read_header(FFV1Context *f)
} else {
const uint8_t *p = c->bytestream_end;
for (f->slice_count = 0;
- f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start;
+ f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start;
f->slice_count++) {
int trailer = 3 + 5*!!f->ec;
int size = AV_RB24(p-trailer);