If bytes is large enough, bytes*8 can overflow and become negative.
In that case 'bufsize -= bytes*8' causes bufsize to increase instead of
decrease.
This leads to a segmentation fault.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavcodec/diracdec.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c
index 0453a97..b77c5fb 100644
--- a/libavcodec/diracdec.c
+++ b/libavcodec/diracdec.c
@@ -801,7 +801,10 @@ static int decode_lowdelay(DiracContext *s)
slice_num++;
buf += bytes;
- bufsize -= bytes*8;
+ if (bufsize/8 >= bytes)
+ bufsize -= bytes*8;
+ else
+ bufsize = 0;
}
avctx->execute(avctx, decode_lowdelay_slice, slices, NULL, slice_num,
--
2.1.4
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
