aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/kgv1dec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-01-25 23:23:35 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-01-25 23:25:45 +0100
commit807a045ab7f51993a2c1b3116016cbbd4f3d20d6 (patch)
treeca5c9e56ba0c8b8bd6aa609f00e6fbd314ce6b52 /libavcodec/kgv1dec.c
parent2f3a86a7613757bf3aa6352d6dc4741e0419108e (diff)
downloadffmpeg-807a045ab7f51993a2c1b3116016cbbd4f3d20d6.tar.gz
kgv1dec: Increase offsets array size so it is large enough.
Fixes CVE-2011-3945 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/kgv1dec.c')
-rw-r--r--libavcodec/kgv1dec.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/kgv1dec.c b/libavcodec/kgv1dec.c
index 398b8af0d5..4566e35b74 100644
--- a/libavcodec/kgv1dec.c
+++ b/libavcodec/kgv1dec.c
@@ -39,7 +39,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
const uint8_t *buf = avpkt->data;
const uint8_t *buf_end = buf + avpkt->size;
KgvContext * const c = avctx->priv_data;
- int offsets[7];
+ int offsets[8];
uint16_t *out, *prev;
int outcnt = 0, maxcnt;
int w, h, i;
@@ -69,7 +69,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
return -1;
c->prev = prev;
- for (i = 0; i < 7; i++)
+ for (i = 0; i < 8; i++)
offsets[i] = -1;
while (outcnt < maxcnt && buf_end - 2 > buf) {