On 21/09/16 18:11, Vittorio Giovara wrote:
> Avoid out of bounds access.
> ---
>  libavcodec/vp3.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
> index 26374cc..40e9498 100644
> --- a/libavcodec/vp3.c
> +++ b/libavcodec/vp3.c
> @@ -2274,8 +2274,15 @@ static int theora_decode_header(AVCodecContext *avctx, 
> GetBitContext *gb)
>      skip_bits(gb, 6); /* quality hint */
>  
>      if (s->theora >= 0x030200) {
> +        unsigned int idx;
> +
>          skip_bits(gb, 5); /* keyframe frequency force */
> -        avctx->pix_fmt = theora_pix_fmts[get_bits(gb, 2)];
> +

get_bits in theory should return 0, 1, 2, 3, the theora_pix_fmts array
has 4 elements.

I guess get_bits can return random values in certain conditions.

lu

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to