Quoting Luca Barbato (2016-08-19 10:40:56)
> On 19/08/16 09:15, Anton Khirnov wrote:
> >> for (i = 0; i < data->nb_au_headers; ++i) {
> >> > - data->au_headers[i].size = get_bits_long(&getbitcontext,
> >> > data->sizelength);
> >> > - data->au_headers[i].index = get_bits_long(&getbitcontext,
> >> > data->indexlength);
> >> > + data->au_headers[i].size = bitstream_read(&bctx,
> >> > data->sizelength);
> >> > + data->au_headers[i].index = bitstream_read(&bctx,
> >> > data->indexlength);
> > What guarantees that the sizes are bounded by 32?
>
> Nothing from what I can see.
I agree. Then this code is wrong.
--
Anton Khirnov
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
