generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

diracdec: avoid overflow of bytes*8 in decode_lowdelay

Browse Source 
If bytes is large enough, bytes*8 can overflow and become negative.

In that case 'bufsize -= bytes*8' causes bufsize to increase instead of
decrease.

This leads to a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 9e66b39aa8)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Andreas Cadhalpun
2015-05-05 22:10:44 +02:00
committed by Michael Niedermayer
parent e67181a351
commit 448d6488b1
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/diracdec.c
View File

@@ -799,7 +799,10 @@ static void decode_lowdelay(DiracContext *s)
slice_num++; slice_num++;
buf += bytes; buf += bytes;
bufsize -= bytes*8; if (bufsize/8 >= bytes)
bufsize -= bytes*8;
else
bufsize = 0;
} }
avctx->execute(avctx, decode_lowdelay_slice, slices, NULL, slice_num, avctx->execute(avctx, decode_lowdelay_slice, slices, NULL, slice_num,