projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
02055b6
)
shorten: set invalid channels count to 0
author
Michael Niedermayer
<michaelni@gmx.at>
Tue, 5 Mar 2013 14:13:04 +0000
(15:13 +0100)
committer
Luca Barbato
<lu_zero@gentoo.org>
Wed, 6 Mar 2013 00:04:01 +0000
(
01:04
+0100)
Prevent the loop shorten_decode_close from writing and freeing out of
the array boundary.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavcodec/shorten.c
patch
|
blob
|
history
diff --git
a/libavcodec/shorten.c
b/libavcodec/shorten.c
index
e678ee8
..
d99877b
100644
(file)
--- a/
libavcodec/shorten.c
+++ b/
libavcodec/shorten.c
@@
-341,6
+341,7
@@
static int read_header(ShortenContext *s)
s->channels = get_uint(s, CHANSIZE);
if (s->channels <= 0 || s->channels > MAX_CHANNELS) {
av_log(s->avctx, AV_LOG_ERROR, "too many channels: %d\n", s->channels);
+ s->channels = 0;
return -1;
}
s->avctx->channels = s->channels;