[FFmpeg-devel] [PATCH 1/3] avformat/aviobuf: read till the very end of the IO buffer

[Paul B Mahol]

On Sun, Sep 20, 2020 at 10:52:51AM +0200, Marton Balint wrote:
> There was an off-by-one error when checking if the IO buffer still has enough
> space till the end.

How to reproduce such error(s)?

> 
> Signed-off-by: Marton Balint <cus at passwd.hu>
> ---
>  libavformat/aviobuf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
> index a77517d712..9675425349 100644
> --- a/libavformat/aviobuf.c
> +++ b/libavformat/aviobuf.c
> @@ -540,7 +540,7 @@ static void fill_buffer(AVIOContext *s)
>  {
>      int max_buffer_size = s->max_packet_size ?
>                            s->max_packet_size : IO_BUFFER_SIZE;
> -    uint8_t *dst        = s->buf_end - s->buffer + max_buffer_size < s->buffer_size ?
> +    uint8_t *dst        = s->buf_end - s->buffer + max_buffer_size <= s->buffer_size ?
>                            s->buf_end : s->buffer;
>      int len             = s->buffer_size - (dst - s->buffer);
>  
> -- 
> 2.26.2
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request at ffmpeg.org with subject "unsubscribe".