From 442c3a8cb1785d74f8e2d7ab35b1862b7088436b Mon Sep 17 00:00:00 2001
From: "Ronald S. Bultje" <rsbultje@gmail.com>
Date: Thu, 8 Mar 2012 17:09:27 -0800
Subject: cook: expand dither_tab[], and make sure indexes into it don't
 overflow.

Fixes overflows in accessing dither_tab[].

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
 libavcodec/cook.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'libavcodec/cook.c')

diff --git a/libavcodec/cook.c b/libavcodec/cook.c
index 65e16e4077..41ce0e528e 100644
--- a/libavcodec/cook.c
+++ b/libavcodec/cook.c
@@ -507,7 +507,11 @@ static inline void expand_category(COOKContext *q, int *category,
 {
     int i;
     for (i = 0; i < q->num_vectors; i++)
-        ++category[category_index[i]];
+    {
+        int idx = category_index[i];
+        if (++category[idx] >= FF_ARRAY_ELEMS(dither_tab))
+            --category[idx];
+    }
 }
 
 /**
-- 
cgit v1.2.3