Skip to content

Commit d893253

Browse files
committed
avcodec/ffv1dec: Fix out of array read in slice counting
Fixes: test-201710.mp4 Found-by: 连一汉 <lianyihan@360.cn> and Zhibin Hu Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit c20f4fc) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent bf10b86 commit d893253

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Diff for: libavcodec/ffv1dec.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -787,7 +787,7 @@ static int read_header(FFV1Context *f)
787787
} else {
788788
const uint8_t *p = c->bytestream_end;
789789
for (f->slice_count = 0;
790-
f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start;
790+
f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start;
791791
f->slice_count++) {
792792
int trailer = 3 + 5*!!f->ec;
793793
int size = AV_RB24(p-trailer);

0 commit comments

Comments
 (0)