Module: libav Branch: release/0.7 Commit: b4a1bf0bbf53cc6a736a608732b2ac1de5c2447b
Author: Laurent Aimar <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Sat Sep 17 16:56:30 2011 +0200 rv34: Fix potential overreads Signed-off-by: Martin Storsjö <[email protected]> (cherry picked from commit b4ed3d78cb6c41c9d3ee5918c326ab925edd6a89) Signed-off-by: Anton Khirnov <[email protected]> --- libavcodec/rv34.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index 2383903..87fca5c 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1436,6 +1436,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, slice_count = (*buf++) + 1; slices_hdr = buf + 4; buf += 8 * slice_count; + buf_size -= 1 + 8 * slice_count; }else slice_count = avctx->slice_count; @@ -1454,7 +1455,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B) || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I) || avctx->skip_frame >= AVDISCARD_ALL) - return buf_size; + return avpkt->size; for(i=0; i<slice_count; i++){ int offset= get_slice_offset(avctx, slices_hdr, i); @@ -1503,7 +1504,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, } s->current_picture_ptr= NULL; //so we can detect if frame_end wasnt called (find some nicer solution...) } - return buf_size; + return avpkt->size; } av_cold int ff_rv34_decode_end(AVCodecContext *avctx) _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
