aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/cook.c
diff options
context:
space:
mode:
authorRonald S. Bultje <rsbultje@gmail.com>2012-03-08 17:09:27 -0800
committerRonald S. Bultje <rsbultje@gmail.com>2012-03-10 12:03:53 -0800
commit442c3a8cb1785d74f8e2d7ab35b1862b7088436b (patch)
tree831579a42b9c2712a5903f1153281ea0800b00cc /libavcodec/cook.c
parent71af42bd964313b3869cdd8a8c0fb97a9ee90d49 (diff)
downloadffmpeg-442c3a8cb1785d74f8e2d7ab35b1862b7088436b.tar.gz
cook: expand dither_tab[], and make sure indexes into it don't overflow.
Fixes overflows in accessing dither_tab[]. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/cook.c')
-rw-r--r--libavcodec/cook.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 65e16e4077..41ce0e528e 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -507,7 +507,11 @@ static inline void expand_category(COOKContext *q, int *category,
{
int i;
for (i = 0; i < q->num_vectors; i++)
- ++category[category_index[i]];
+ {
+ int idx = category_index[i];
+ if (++category[idx] >= FF_ARRAY_ELEMS(dither_tab))
+ --category[idx];
+ }
}
/**