comparison ffv1.c @ 9523:3045aef3405c libavcodec

Fix a possibly exploitable buffer overflow.
author michael
date Tue, 21 Apr 2009 12:00:39 +0000
parents 71608a4f9eb7
children 54ddf2b7d4bd
comparison
equal deleted inserted replaced
9522:bf81b6f776ea 9523:3045aef3405c
247 if(get_rac(c, state+0)) 247 if(get_rac(c, state+0))
248 return 0; 248 return 0;
249 else{ 249 else{
250 int i, e, a; 250 int i, e, a;
251 e= 0; 251 e= 0;
252 while(get_rac(c, state+1 + e)){ //1..10 252 while(get_rac(c, state+1 + e) && e<9){ //1..10
253 e++; 253 e++;
254 } 254 }
255 assert(e<=9);
256 255
257 a= 1; 256 a= 1;
258 for(i=e-1; i>=0; i--){ 257 for(i=e-1; i>=0; i--){
259 a += a + get_rac(c, state+22 + i); //22..31 258 a += a + get_rac(c, state+22 + i); //22..31
260 } 259 }