Fix a possibly exploitable buffer overflow.

Originally committed as revision 18640 to svn://svn.ffmpeg.org/ffmpeg/trunk
16 years ago · 223d996aaf
parent f7cf12b209
commit 223d996aaf
1 changed files with 1 additions and 2 deletions
--- a/libavcodec/ffv1.c
+++ b/libavcodec/ffv1.c
@ -249,10 +249,9 @@ static inline int get_symbol(RangeCoder *c, uint8_t *state, int is_signed){
    else{
        int i, e, a;
        e= 0;
-        while(get_rac(c, state+1 + e)){ //1..10
+        while(get_rac(c, state+1 + e) && e<9){ //1..10
            e++;
        }
-        assert(e<=9);

        a= 1;
        for(i=e-1; i>=0; i--){