har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix a heap-buffer-overflow

Browse Source 
In some case, what left to read from ptr is smaller than EXTRABYTES.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Thierry Foucu 2012-01-25 15:46:14 -08:00 committed by Michael Niedermayer
parent 3c5fe5b527
commit 10e9d1f76b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/mpegaudiodec.c
View File

@ -1385,7 +1385,8 @@ static int mp_decode_layer3(MPADecodeContext *s)
av_dlog(s->avctx, "seekback: %d\n", main_data_begin); av_dlog(s->avctx, "seekback: %d\n", main_data_begin);
//av_log(NULL, AV_LOG_ERROR, "backstep:%d, lastbuf:%d\n", main_data_begin, s->last_buf_size); //av_log(NULL, AV_LOG_ERROR, "backstep:%d, lastbuf:%d\n", main_data_begin, s->last_buf_size);
memcpy(s->last_buf + s->last_buf_size, ptr, EXTRABYTES); memcpy(s->last_buf + s->last_buf_size, ptr,
FFMIN(EXTRABYTES, (s->gb.size_in_bits - get_bits_count(&s->gb))>>3));
s->in_gb = s->gb; s->in_gb = s->gb;
init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8); init_get_bits(&s->gb, s->last_buf, s->last_buf_size*8);
#if !UNCHECKED_BITSTREAM_READER #if !UNCHECKED_BITSTREAM_READER