diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2009-04-21 12:00:39 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2009-04-21 12:00:39 +0000 |
| commit | 223d996aaf9f1668c28519d3d7eb756e6cdf3fcf (patch) | |
| tree | b984b1f62f757d72cdb9ba15c76bc02ed68a321c /libavcodec/ffv1.c | |
| parent | f7cf12b209c3a1ac2d6b797c585b593a5e9a461d (diff) | |
| download | ffmpeg-223d996aaf9f1668c28519d3d7eb756e6cdf3fcf.tar.gz | |
Fix a possibly exploitable buffer overflow.
Originally committed as revision 18640 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/ffv1.c')
| -rw-r--r-- | libavcodec/ffv1.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/libavcodec/ffv1.c b/libavcodec/ffv1.c index 86f2897434..9eef531d59 100644 --- a/libavcodec/ffv1.c +++ b/libavcodec/ffv1.c @@ -249,10 +249,9 @@ static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){ else{ int i, e, a; e= 0; - while(get_rac(c, state+1 + e)){ //1..10 + while(get_rac(c, state+1 + e) && e<9){ //1..10 e++; } - assert(e<=9); a= 1; for(i=e-1; i>=0; i--){ |