Arrays where one element too small, fixes CID114.

this was possibly exploitable

Originally committed as revision 13475 to svn://svn.ffmpeg.org/ffmpeg/trunk
pull/126/head
Michael Niedermayer 17 years ago
parent 5e5c908691
commit 6138ed777d
  1. 4
      libavcodec/cavsdec.c

@ -116,8 +116,8 @@ static int decode_residual_block(AVSContext *h, GetBitContext *gb,
const dec_2dvlc_t *r, int esc_golomb_order,
int qp, uint8_t *dst, int stride) {
int i, level_code, esc_code, level, run, mask;
DCTELEM level_buf[64];
uint8_t run_buf[64];
DCTELEM level_buf[65];
uint8_t run_buf[65];
DCTELEM *block = h->block;
for(i=0;i<65;i++) {

Loading…
Cancel
Save