From 5a75924dfd432c0ada79a9f489889dc92d53b481 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 12 Oct 2012 02:06:51 +0200 Subject: rtmpproto: fix out of array write Fixes CID732263 Signed-off-by: Michael Niedermayer --- libavformat/rtmpproto.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavformat/rtmpproto.c') diff --git a/libavformat/rtmpproto.c b/libavformat/rtmpproto.c index 518e7b290a..d76a5114dc 100644 --- a/libavformat/rtmpproto.c +++ b/libavformat/rtmpproto.c @@ -1371,9 +1371,9 @@ static int rtmp_server_handshake(URLContext *s, RTMPContext *rt) /* By now same epoch will be sent */ hs_my_epoch = hs_epoch; /* Generate random */ - for (randomidx = 0; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE); + for (randomidx = 8; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE); randomidx += 4) - AV_WB32(hs_s1 + 8 + randomidx, av_get_random_seed()); + AV_WB32(hs_s1 + randomidx, av_get_random_seed()); ret = rtmp_send_hs_packet(rt, hs_my_epoch, 0, hs_s1, RTMP_HANDSHAKE_PACKET_SIZE); -- cgit v1.2.3