diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-17 16:56:30 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-17 17:38:26 +0200 |
| commit | 9a0a64cb26bc6aaa7f29106bded8a27f3db918ee (patch) | |
| tree | a6a8d0bc4ec317c2e4607dddf45cf0553e1a4487 /libavcodec/rv34.c | |
| parent | bfadca1faf7eb131d15181a8d0df2bb5c2662b37 (diff) | |
| download | ffmpeg-9a0a64cb26bc6aaa7f29106bded8a27f3db918ee.tar.gz | |
Fix potential overreads in rv34 decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/rv34.c')
| -rw-r--r-- | libavcodec/rv34.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index 6c511865cb..6d4e6e35f9 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1483,6 +1483,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, slice_count = (*buf++) + 1; slices_hdr = buf + 4; buf += 8 * slice_count; + buf_size -= 1 + 8 * slice_count; }else slice_count = avctx->slice_count; @@ -1501,7 +1502,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B) || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I) || avctx->skip_frame >= AVDISCARD_ALL) - return buf_size; + return avpkt->size; for(i = 0; i < slice_count; i++){ int offset = get_slice_offset(avctx, slices_hdr, i); @@ -1550,7 +1551,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, } s->current_picture_ptr = NULL; //so we can detect if frame_end wasnt called (find some nicer solution...) } - return buf_size; + return avpkt->size; } av_cold int ff_rv34_decode_end(AVCodecContext *avctx) |