OSDN Git Service
(root)
/
coroid
/
libav_saccubus.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
5e5c908
)
Arrays where one element too small, fixes CID114.
author
Michael Niedermayer
<michaelni@gmx.at>
Tue, 27 May 2008 22:10:17 +0000
(22:10 +0000)
committer
Michael Niedermayer
<michaelni@gmx.at>
Tue, 27 May 2008 22:10:17 +0000
(22:10 +0000)
this was possibly exploitable
Originally committed as revision 13475 to svn://svn.ffmpeg.org/ffmpeg/trunk
libavcodec/cavsdec.c
patch
|
blob
|
history
diff --git
a/libavcodec/cavsdec.c
b/libavcodec/cavsdec.c
index
a7ce883
..
b212eb9
100644
(file)
--- a/
libavcodec/cavsdec.c
+++ b/
libavcodec/cavsdec.c
@@
-116,8
+116,8
@@
static int decode_residual_block(AVSContext *h, GetBitContext *gb,
const dec_2dvlc_t *r, int esc_golomb_order,
int qp, uint8_t *dst, int stride) {
int i, level_code, esc_code, level, run, mask;
- DCTELEM level_buf[6
4
];
- uint8_t run_buf[6
4
];
+ DCTELEM level_buf[6
5
];
+ uint8_t run_buf[6
5
];
DCTELEM *block = h->block;
for(i=0;i<65;i++) {