diff options
author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-02-08 15:44:17 +0100 |
---|---|---|
committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2024-02-09 10:20:21 +0100 |
commit | d30fe36b88983feb7c48fc22a4bc03868248c479 (patch) | |
tree | f9ea0378b8f121a681651f11dcb3518ca332489c /libavcodec/ass.h | |
parent | 2b0e9e278a410ca59c06e526c14a3b068ce5bc64 (diff) | |
download | ffmpeg-d30fe36b88983feb7c48fc22a4bc03868248c479.tar.gz |
avformat/rcwtenc: Fix potential out-of-bounds write
The rcwt muxer uses several counters for how much data
it has already cached: One byte counter and one counter
for how many complete blocks (of three bytes each).
These counters can become inconsistent when the muxer is
fed incomplete blocks as the muxer presumes that it is
about to write a new block at the start of each write_packet
call. E.g. sending 65535*3+1 1-byte packets (with data[0] e.g. 0x03)
will trigger an out-of-bounds write.
This patch fixes this by processing the data in complete blocks
only. This also allows to simplify the code, e.g. to remove one of
the counters.
Reviewed-by: Marth64 <marth64@proxyid.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavcodec/ass.h')
0 files changed, 0 insertions, 0 deletions