From 362271d72fc38cd1f4b076aff9a12b1104c26760 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 27 Jan 2013 02:08:22 +0100 Subject: mvdec: Check the frame counter against the correct limit. fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavformat/mvdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavformat/mvdec.c') diff --git a/libavformat/mvdec.c b/libavformat/mvdec.c index c58567cad4..03471f1556 100644 --- a/libavformat/mvdec.c +++ b/libavformat/mvdec.c @@ -372,7 +372,7 @@ static int mv_read_packet(AVFormatContext *avctx, AVPacket *pkt) int ret; uint64_t pos; - if (frame < st->nb_frames) { + if (frame < st->nb_index_entries) { index = &st->index_entries[frame]; pos = avio_tell(pb); if (index->pos > pos) -- cgit v1.2.3