From c41ac870470c614185e1752c11f892809022248a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 13 Apr 2012 23:56:26 +0200 Subject: [PATCH] avidec: update size when packet is shrunk Fixes out of array read Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/avidec.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/avidec.c b/libavformat/avidec.c index 0067ff98f2..b78a3d2a2b 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -1125,6 +1125,7 @@ resync: err= av_get_packet(pb, pkt, size); if(err<0) return err; + size = err; if(ast->has_pal && pkt->data && pkt->size<(unsigned)INT_MAX/2){ uint8_t *pal;