From 2f1b2ff934e672c7ad5d8f1efe887350edc4daec Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 12 Oct 2012 02:06:51 +0200 Subject: [PATCH] rtmpproto: Fix an out of array write MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Martin Storsjö --- libavformat/rtmpproto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index a5bc246e31..3ab2e57e62 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -1371,9 +1371,9 @@ static int rtmp_server_handshake(URLContext *s, RTMPContext *rt) /* By now same epoch will be sent */ hs_my_epoch = hs_epoch; /* Generate random */ - for (randomidx = 0; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE); + for (randomidx = 8; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE); randomidx += 4) - AV_WB32(hs_s1 + 8 + randomidx, av_get_random_seed()); + AV_WB32(hs_s1 + randomidx, av_get_random_seed()); ret = rtmp_send_hs_packet(rt, hs_my_epoch, 0, hs_s1, RTMP_HANDSHAKE_PACKET_SIZE);