dv: Add a guard to not overread the ppcm array

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

diff --git a/libavformat/dv.c b/libavformat/dv.c
index d52be5d..b0dad63 100644 (file)
--- a/libavformat/dv.c
+++ b/libavformat/dv.c
@@ -108,7 +108,7 @@ static const int dv_audio_frequency[3] = {
  * 3. Audio is always returned as 16bit linear samples: 12bit nonlinear samples
  *    are converted into 16bit linear ones.
  */
-static int dv_extract_audio(uint8_t *frame, uint8_t *ppcm[4],
+static int dv_extract_audio(uint8_t *frame, uint8_t **ppcm,
                             const DVprofile *sys)
 {
     int size, chan, i, j, d, of, smpls, freq, quant, half_ch;
@@ -344,7 +344,7 @@ int avpriv_dv_produce_packet(DVDemuxContext *c, AVPacket *pkt,
                              uint8_t *buf, int buf_size)
 {
     int size, i;
-    uint8_t *ppcm[4] = { 0 };
+    uint8_t *ppcm[5] = { 0 };
 
     if (buf_size < DV_PROFILE_BYTES ||
         !(c->sys = avpriv_dv_frame_profile(c->sys, buf, buf_size)) ||