ffmpeg | branch: release/3.2 | Matt Wolenetz <wolen...@chromium.org> | Mon Nov 21 15:54:02 2016 -0800| [2481f1320a7f3073415897e4ba82c1455f0ec996] | committer: Michael Niedermayer
lavf/utils.c Protect against accessing entries[nb_entries] In ff_index_search_timestamp(), if b == num_entries, m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is true, then the search for the next non-discarded packet could access entries[nb_entries], exceeding its bounds. This change adds a protection against that scenario. Reference: https://crbug.com/666770 Reviewed-by: Sasi Inguva <is...@google.com> Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> (cherry picked from commit fe7547d69e6721d064c8604d0a6375a2d24b35ca) Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2481f1320a7f3073415897e4ba82c1455f0ec996 --- libavformat/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/utils.c b/libavformat/utils.c index 1df0ec0..55f23ba 100644 --- a/libavformat/utils.c +++ b/libavformat/utils.c @@ -1980,7 +1980,7 @@ int ff_index_search_timestamp(const AVIndexEntry *entries, int nb_entries, m = (a + b) >> 1; // Search for the next non-discarded packet. - while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) { + while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m < nb_entries - 1) { m++; if (m == b && entries[m].timestamp >= wanted_timestamp) { m = b - 1; _______________________________________________ ffmpeg-cvslog mailing list ffmpeg-cvslog@ffmpeg.org http://ffmpeg.org/mailman/listinfo/ffmpeg-cvslog
