From c20f4fcb74da2d0432c7b54499bb98f48236b904 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 9 Oct 2017 11:49:28 +0200 Subject: avcodec/ffv1dec: Fix out of array read in slice counting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes: test-201710.mp4 Found-by: 连一汉 and Zhibin Hu Signed-off-by: Michael Niedermayer --- libavcodec/ffv1dec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavcodec/ffv1dec.c') diff --git a/libavcodec/ffv1dec.c b/libavcodec/ffv1dec.c index d2bfee784f..5eadb6b158 100644 --- a/libavcodec/ffv1dec.c +++ b/libavcodec/ffv1dec.c @@ -717,7 +717,7 @@ static int read_header(FFV1Context *f) } else { const uint8_t *p = c->bytestream_end; for (f->slice_count = 0; - f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start; + f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start; f->slice_count++) { int trailer = 3 + 5*!!f->ec; int size = AV_RB24(p-trailer); -- cgit v1.2.3