diff options
| author | Roman Shaposhnik <roman@shaposhnik.org> | 2004-07-28 21:56:59 +0000 |
|---|---|---|
| committer | Roman Shaposhnik <roman@shaposhnik.org> | 2004-07-28 21:56:59 +0000 |
| commit | f5fc28d23c46d334c809c11d62651d0080f1c325 (patch) | |
| tree | 917ee6a906b9a4a8b39f0c0e6f96915ed6e2941d | |
| parent | 668fe04e39391d88216985742f747432526d7707 (diff) | |
* fixing a buffer overrun in gif.c
Originally committed as revision 3363 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavformat/gif.c | 8 | ||||
| -rw-r--r-- | tests/libav.regression.ref | 4 |
2 files changed, 5 insertions, 7 deletions
diff --git a/libavformat/gif.c b/libavformat/gif.c index 3a5f041e61..84809bf659 100644 --- a/libavformat/gif.c +++ b/libavformat/gif.c @@ -252,7 +252,7 @@ static int gif_image_write_image(ByteIOContext *pb, gif_put_bits_rev(&p, 9, 0x0100); /* clear code */ - for(i=0;i<GIF_CHUNKS;i++) { + for(i=(left<GIF_CHUNKS)?left:GIF_CHUNKS;i;i--) { if (pix_fmt == PIX_FMT_RGB24) { v = gif_clut_index(ptr[0], ptr[1], ptr[2]); ptr+=3; @@ -276,12 +276,10 @@ static int gif_image_write_image(ByteIOContext *pb, put_buffer(pb, p.buf, pbBufPtr(&p) - p.buf); /* the actual buffer */ p.buf_ptr = p.buf; /* dequeue the bytes off the bitstream */ } - if(left<=GIF_CHUNKS) { - put_byte(pb, 0x00); /* end of image block */ - } - left-=GIF_CHUNKS; } + put_byte(pb, 0x00); /* end of image block */ + return 0; } diff --git a/tests/libav.regression.ref b/tests/libav.regression.ref index 3c6a6d6a87..c90d2432d4 100644 --- a/tests/libav.regression.ref +++ b/tests/libav.regression.ref @@ -37,8 +37,8 @@ b28918de1199e60a7ac235eefacb7d3b *./data/b-libav.dv 0c5fe86621b7377705837f304d4ba1e9 *./data/b-libav.ppm 7603575 ./data/b-libav.ppm ./data/b-libav.ppm CRC=b2bb8e92 -1cac531652ea2ff2fb141d5ae992caa8 *./data/b-libav.gif -2907057 ./data/b-libav.gif +88a98269295fbfce7816558ad84e1259 *./data/b-libav.gif +2906382 ./data/b-libav.gif c39dd19b88f9e0f03a318b51c37edb61 *./data/b-libav.yuv4mpeg 3801810 ./data/b-libav.yuv4mpeg ./data/b-libav%d.pgm CRC=84c09106 |