[FFmpeg-cvslog] Fix potential overreads in rv34 decoder.
Laurent Aimar
git at videolan.org
Wed Sep 21 21:08:38 CEST 2011
ffmpeg | branch: release/0.8 | Laurent Aimar <fenrir at videolan.org> | Sat Sep 17 16:56:30 2011 +0200| [30d7dce94fc74a8ef8369ffe97f0b8b5484ff502] | committer: Michael Niedermayer
Fix potential overreads in rv34 decoder.
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 9a0a64cb26bc6aaa7f29106bded8a27f3db918ee)
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=30d7dce94fc74a8ef8369ffe97f0b8b5484ff502
---
libavcodec/rv34.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index f0f472d..ba88916 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1443,6 +1443,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
slice_count = (*buf++) + 1;
slices_hdr = buf + 4;
buf += 8 * slice_count;
+ buf_size -= 1 + 8 * slice_count;
}else
slice_count = avctx->slice_count;
@@ -1461,7 +1462,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B)
|| (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I)
|| avctx->skip_frame >= AVDISCARD_ALL)
- return buf_size;
+ return avpkt->size;
for(i=0; i<slice_count; i++){
int offset= get_slice_offset(avctx, slices_hdr, i);
@@ -1510,7 +1511,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
}
s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...)
}
- return buf_size;
+ return avpkt->size;
}
av_cold int ff_rv34_decode_end(AVCodecContext *avctx)
More information about the ffmpeg-cvslog
mailing list