From 187630b2449f1eae1096f81f31bab7d81bed3cf1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tomas=20H=C3=A4rdin?= Date: Wed, 24 Oct 2012 16:50:26 +0200 Subject: [PATCH] mxfdec: Fix CID 732262 Coverity thinks ofs can end up 15, thus writing past the end of layout[]. This is incorrect since it's always incremented by 2. Checking ofs <= 14 makes Coverity happy and doesn't hurt. Signed-off-by: Michael Niedermayer --- libavformat/mxfdec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mxfdec.c b/libavformat/mxfdec.c index 1f583b8ad6..3f6b7d9b5e 100644 --- a/libavformat/mxfdec.c +++ b/libavformat/mxfdec.c @@ -782,14 +782,14 @@ static int mxf_read_index_table_segment(void *arg, AVIOContext *pb, int tag, int static void mxf_read_pixel_layout(AVIOContext *pb, MXFDescriptor *descriptor) { int code, value, ofs = 0; - char layout[16] = {0}; + char layout[16] = {0}; /* not for printing, may end up not terminated on purpose */ do { code = avio_r8(pb); value = avio_r8(pb); av_dlog(NULL, "pixel layout: code %#x\n", code); - if (ofs < 16) { + if (ofs <= 14) { layout[ofs++] = code; layout[ofs++] = value; }