diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 21:03:11 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 21:03:11 +0100 |
| commit | f83687bc78bea7ede4859d363c24a28f0473a5db (patch) | |
| tree | 7eac304ca63e27c8414c83d220a1e614de839a73 /libavformat/mpegts.c | |
| parent | 4a310a19dea268b541a099515d73fda04dc642e9 (diff) | |
| download | ffmpeg-f83687bc78bea7ede4859d363c24a28f0473a5db.tar.gz | |
mpegts: fix stack array overread in read_sl_header()
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/mpegts.c')
| -rw-r--r-- | libavformat/mpegts.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c index e6c353df0e..460372c116 100644 --- a/libavformat/mpegts.c +++ b/libavformat/mpegts.c @@ -1822,7 +1822,7 @@ static int read_packet(AVFormatContext *s, uint8_t *buf, int raw_packet_size) static int handle_packets(MpegTSContext *ts, int nb_packets) { AVFormatContext *s = ts->stream; - uint8_t packet[TS_PACKET_SIZE]; + uint8_t packet[TS_PACKET_SIZE + FF_INPUT_BUFFER_PADDING_SIZE]; int packet_num, ret = 0; if (avio_tell(s->pb) != ts->last_pos) { |