diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-10-12 02:06:51 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-10-12 02:06:51 +0200 |
| commit | 5a75924dfd432c0ada79a9f489889dc92d53b481 (patch) | |
| tree | 45c08399b836d2b6d45877db91b36dd100d038db /libavformat/rtmpproto.c | |
| parent | e576105d841c573b0d175db1a77d393494222133 (diff) | |
| download | ffmpeg-5a75924dfd432c0ada79a9f489889dc92d53b481.tar.gz | |
rtmpproto: fix out of array write
Fixes CID732263
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/rtmpproto.c')
| -rw-r--r-- | libavformat/rtmpproto.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index 518e7b290a..d76a5114dc 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -1371,9 +1371,9 @@ static int rtmp_server_handshake(URLContext *s, RTMPContext *rt) /* By now same epoch will be sent */ hs_my_epoch = hs_epoch; /* Generate random */ - for (randomidx = 0; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE); + for (randomidx = 8; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE); randomidx += 4) - AV_WB32(hs_s1 + 8 + randomidx, av_get_random_seed()); + AV_WB32(hs_s1 + randomidx, av_get_random_seed()); ret = rtmp_send_hs_packet(rt, hs_my_epoch, 0, hs_s1, RTMP_HANDSHAKE_PACKET_SIZE); |