changeset 6913:e716466d3665 libavcodec

Arrays where one element too small, fixes CID114. this was possibly exploitable
author michael
date Tue, 27 May 2008 22:10:17 +0000
parents 941a4e753961
children 224b51e2c960
files cavsdec.c
diffstat 1 files changed, 2 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/cavsdec.c	Tue May 27 21:12:28 2008 +0000
+++ b/cavsdec.c	Tue May 27 22:10:17 2008 +0000
@@ -116,8 +116,8 @@
                                  const dec_2dvlc_t *r, int esc_golomb_order,
                                  int qp, uint8_t *dst, int stride) {
     int i, level_code, esc_code, level, run, mask;
-    DCTELEM level_buf[64];
-    uint8_t run_buf[64];
+    DCTELEM level_buf[65];
+    uint8_t run_buf[65];
     DCTELEM *block = h->block;
 
     for(i=0;i<65;i++) {