aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/libvpxdec.c
diff options
context:
space:
mode:
authorAndreas Rheinhardt <andreas.rheinhardt@outlook.com>2024-02-08 15:44:17 +0100
committerAndreas Rheinhardt <andreas.rheinhardt@outlook.com>2024-02-09 10:20:21 +0100
commitd30fe36b88983feb7c48fc22a4bc03868248c479 (patch)
treef9ea0378b8f121a681651f11dcb3518ca332489c /libavcodec/libvpxdec.c
parent2b0e9e278a410ca59c06e526c14a3b068ce5bc64 (diff)
downloadffmpeg-d30fe36b88983feb7c48fc22a4bc03868248c479.tar.gz
avformat/rcwtenc: Fix potential out-of-bounds write
The rcwt muxer uses several counters for how much data it has already cached: One byte counter and one counter for how many complete blocks (of three bytes each). These counters can become inconsistent when the muxer is fed incomplete blocks as the muxer presumes that it is about to write a new block at the start of each write_packet call. E.g. sending 65535*3+1 1-byte packets (with data[0] e.g. 0x03) will trigger an out-of-bounds write. This patch fixes this by processing the data in complete blocks only. This also allows to simplify the code, e.g. to remove one of the counters. Reviewed-by: Marth64 <marth64@proxyid.net> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Diffstat (limited to 'libavcodec/libvpxdec.c')
0 files changed, 0 insertions, 0 deletions