avfilter/ff_insert_pad: fix order of operations

Fixes out of bounds access
Fixes CID732170
Fixes CID732169

No filter is known to use this function in a way so the issue can be reproduced.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c
index 7ce82f8..f31968f 100644 (file)
--- a/libavfilter/avfilter.c
+++ b/libavfilter/avfilter.c
@@ -119,8 +119,8 @@ int ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off,
 
     (*count)++;
     for (i = idx + 1; i < *count; i++)
-        if (*links[i])
-            (*(unsigned *)((uint8_t *) *links[i] + padidx_off))++;
+        if ((*links)[i])
+            (*(unsigned *)((uint8_t *) (*links)[i] + padidx_off))++;
 
     return 0;
 }