virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

tm2: Fix overread of token array.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-28 07:37:12 +02:00
parent 11cc209226
commit d0dafebb75
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/truemotion2.c
View File

@ -339,8 +339,13 @@ static inline int GET_TOK(TM2Context *ctx,int type) {
av_log(ctx->avctx, AV_LOG_ERROR, "Read token from stream %i out of bounds (%i>=%i)\n", type, ctx->tok_ptrs[type], ctx->tok_lens[type]); av_log(ctx->avctx, AV_LOG_ERROR, "Read token from stream %i out of bounds (%i>=%i)\n", type, ctx->tok_ptrs[type], ctx->tok_lens[type]);
return 0; return 0;
} }
if(type <= TM2_MOT) if(type <= TM2_MOT) {
if (ctx->tokens[type][ctx->tok_ptrs[type]] >= TM2_DELTAS) {
av_log(ctx->avctx, AV_LOG_ERROR, "token %d is too large\n", ctx->tokens[type][ctx->tok_ptrs[type]]);
return 0;
}
return ctx->deltas[type][ctx->tokens[type][ctx->tok_ptrs[type]++]]; return ctx->deltas[type][ctx->tokens[type][ctx->tok_ptrs[type]++]];
}
return ctx->tokens[type][ctx->tok_ptrs[type]++]; return ctx->tokens[type][ctx->tok_ptrs[type]++];
} }