From 2d71f31df23910f18b17f17fa568b13fd5dcaf1a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 10 Nov 2012 19:38:44 +0100 Subject: [PATCH] lag_read_prob_header: fix out of array access Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/lagarith.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c index 6af0d09dc5..0611abfef4 100644 --- a/libavcodec/lagarith.c +++ b/libavcodec/lagarith.c @@ -158,8 +158,8 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb) av_log(rac->avctx, AV_LOG_ERROR, "Invalid probability run encountered.\n"); return -1; } - if (prob > 257 - i) - prob = 257 - i; + if (prob > 256 - i) + prob = 256 - i; for (j = 0; j < prob; j++) rac->prob[++i] = 0; }