highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lavf/utils.c Protect against accessing entries[nb_entries]

Browse Source 
In ff_index_search_timestamp(), if b == num_entries,
m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is
true, then the search for the next non-discarded packet could access
entries[nb_entries], exceeding its bounds. This change adds a protection
against that scenario. Reference: https://crbug.com/666770

Reviewed-by: Sasi Inguva <isasi@google.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fe7547d69e6721d064c8604d0a6375a2d24b35ca)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Matt Wolenetz 2016-11-21 15:54:02 -08:00 committed by Michael Niedermayer
parent ceeeccc862
commit 2481f1320a
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/utils.c
View File

@ -1980,7 +1980,7 @@ int ff_index_search_timestamp(const AVIndexEntry *entries, int nb_entries,
m = (a + b) >> 1;
// Search for the next non-discarded packet.
while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) {
while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m < nb_entries - 1) {
m++;
if (m == b && entries[m].timestamp >= wanted_timestamp) {
m = b - 1;