diff options
author | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2021-11-21 01:57:41 +0100 |
---|---|---|
committer | Andreas Rheinhardt <andreas.rheinhardt@outlook.com> | 2022-01-11 15:15:53 +0100 |
commit | f82aaea3ff35c171ffe5b894026eacbc3c0574de (patch) | |
tree | ce88a237b1267407f372b5692c405ca574e82f74 /tools/python/convert_header.py | |
parent | de82f92b845e8e5e52ea107702eba11ea277800a (diff) | |
download | ffmpeg-f82aaea3ff35c171ffe5b894026eacbc3c0574de.tar.gz |
avcodec/h263: Fix global-buffer-overflow with noout flag2 set
h263_get_motion_length() forgot to take an absolute value;
as a consequence, a negative index was used to access an array.
This leads to potential crashes, but mostly it just accesses what
is to the left of ff_mvtab (unless one uses ASAN), thereby defeating
the purpose of the AV_CODEC_FLAG2_NO_OUTPUT because the sizes of
the returned packets differ from the sizes the encoder would actually
have produced.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
(cherry picked from commit 9207dc3b0db368bb9cf5eb295cbc1129c2975e31)
Diffstat (limited to 'tools/python/convert_header.py')
0 files changed, 0 insertions, 0 deletions