diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-08-21 21:30:36 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-08-21 21:31:46 +0200 |
| commit | cc5e5548df4af48674c7aef518e831b19e99f9fc (patch) | |
| tree | 662b8a836c8984c8c77926f57a0b0d29dcc4dc15 /libavformat | |
| parent | 67318187fbba382d887f9581dde48a50842f1bea (diff) | |
| download | ffmpeg-cc5e5548df4af48674c7aef518e831b19e99f9fc.tar.gz | |
avformat/wtvdec: Check pointer before use
Fixes out of array read
Fixes: 049fdf78565f1ce5665df236d90f8657/asan_heap-oob_10a5a97_1026_42f9d4855547329560f385768de2f3fb.wtv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/wtvdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/wtvdec.c b/libavformat/wtvdec.c index bd32d70dcf..3ac4501306 100644 --- a/libavformat/wtvdec.c +++ b/libavformat/wtvdec.c @@ -1031,7 +1031,7 @@ static int read_header(AVFormatContext *s) while (1) { uint64_t frame_nb = avio_rl64(pb); uint64_t position = avio_rl64(pb); - while (frame_nb > e->size && e <= e_end) { + while (e <= e_end && frame_nb > e->size) { e->pos = last_position; e++; } |