diff options
| author | James Zern <jzern@google.com> | 2015-06-29 23:03:14 -0700 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-30 13:24:19 +0200 |
| commit | e91f860ea74e11e9178500fe8794c47f57dbf48c (patch) | |
| tree | ee0284e6167b11255631d77250f7b0c55d327840 /libavformat/smjpegenc.c | |
| parent | 088b410ea2eebcfdf57f7e0c419fe6be8d440eb6 (diff) | |
| download | ffmpeg-e91f860ea74e11e9178500fe8794c47f57dbf48c.tar.gz | |
vp9/update_prob: prevent out of bounds table read
the max value of the lookup in expanded form is:
(((1 << 7) - 1) << 1) - 65 + 1 + 64 = 254
add one entry of padding to inv_map_table[] to prevent out of bounds
access with non-conforming / fuzzed bitstreams
Signed-off-by: James Zern <jzern@google.com>
Reviewed-by: "Ronald S. Bultje" <rsbultje@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/smjpegenc.c')
0 files changed, 0 insertions, 0 deletions