diff options
| author | Clément Bœsch <ubitux@gmail.com> | 2013-01-01 16:41:37 +0100 |
|---|---|---|
| committer | Clément Bœsch <ubitux@gmail.com> | 2013-01-01 16:41:37 +0100 |
| commit | 7d66bc7920240cc0e8df6c44b2d2cdbe4b228fbe (patch) | |
| tree | 07185ee09494eb12b7d3c559e5b39dd76085db16 /libavcodec/movtextdec.c | |
| parent | 1dd4a21cb787196a331d17683790616946187938 (diff) | |
lavc/movtextdec: keep the min size instead of max to fix overread.
Fixes Ticket #2087.
Diffstat (limited to 'libavcodec/movtextdec.c')
| -rw-r--r-- | libavcodec/movtextdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/movtextdec.c b/libavcodec/movtextdec.c index a65bbb83e3..05ff53afb4 100644 --- a/libavcodec/movtextdec.c +++ b/libavcodec/movtextdec.c @@ -83,7 +83,7 @@ static int mov_text_decode_frame(AVCodecContext *avctx, * In complex cases, there are style descriptors appended to the string * so we can't just assume the packet size is the string size. */ - end = ptr + FFMAX(2 + AV_RB16(ptr), avpkt->size); + end = ptr + FFMIN(2 + AV_RB16(ptr), avpkt->size); ptr += 2; ts_start = av_rescale_q(avpkt->pts, |