diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-23 23:05:44 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-23 23:06:27 +0100 |
| commit | 285485ac5f896cc450e0183daa41a8ee63d17076 (patch) | |
| tree | 0ecba8ee1144160ee136e452a03d3e6586c7eaab /libavformat | |
| parent | 73fce258b774d0480f2d2dd7ec81fa1ec1b27812 (diff) | |
| download | ffmpeg-285485ac5f896cc450e0183daa41a8ee63d17076.tar.gz | |
matroskaenc: fix cue tracknum off by 1 error
Fixes out of array accesses
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/matroskaenc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/matroskaenc.c b/libavformat/matroskaenc.c index 4fbb410726..4544f8e871 100644 --- a/libavformat/matroskaenc.c +++ b/libavformat/matroskaenc.c @@ -407,9 +407,11 @@ static int64_t mkv_write_cues(AVIOContext *pb, mkv_cues *cues, mkv_track *tracks for (j = 0; j < num_tracks; j++) tracks[j].has_cue = 0; for (j = 0; j < cues->num_entries - i && entry[j].pts == pts; j++) { - if (tracks[entry[j].tracknum].has_cue) + int tracknum = entry[j].tracknum - 1; + av_assert0(tracknum>=0 && tracknum<num_tracks); + if (tracks[tracknum].has_cue) continue; - tracks[entry[j].tracknum].has_cue = 1; + tracks[tracknum].has_cue = 1; track_positions = start_ebml_master(pb, MATROSKA_ID_CUETRACKPOSITION, MAX_CUETRACKPOS_SIZE); put_ebml_uint(pb, MATROSKA_ID_CUETRACK , entry[j].tracknum ); put_ebml_uint(pb, MATROSKA_ID_CUECLUSTERPOSITION, entry[j].cluster_pos); |