Mercurial > libavcodec.hg
comparison ffv1.c @ 9523:3045aef3405c libavcodec
Fix a possibly exploitable buffer overflow.
author | michael |
---|---|
date | Tue, 21 Apr 2009 12:00:39 +0000 |
parents | 71608a4f9eb7 |
children | 54ddf2b7d4bd |
comparison
equal
deleted
inserted
replaced
9522:bf81b6f776ea | 9523:3045aef3405c |
---|---|
247 if(get_rac(c, state+0)) | 247 if(get_rac(c, state+0)) |
248 return 0; | 248 return 0; |
249 else{ | 249 else{ |
250 int i, e, a; | 250 int i, e, a; |
251 e= 0; | 251 e= 0; |
252 while(get_rac(c, state+1 + e)){ //1..10 | 252 while(get_rac(c, state+1 + e) && e<9){ //1..10 |
253 e++; | 253 e++; |
254 } | 254 } |
255 assert(e<=9); | |
256 | 255 |
257 a= 1; | 256 a= 1; |
258 for(i=e-1; i>=0; i--){ | 257 for(i=e-1; i>=0; i--){ |
259 a += a + get_rac(c, state+22 + i); //22..31 | 258 a += a + get_rac(c, state+22 + i); //22..31 |
260 } | 259 } |