Michael Niedermayer: > Fixes: out of array access > Fixes: crash-0d640731c7da52415670eb47a2af701cbe2e1a3b > > Found-by: Catena cyber <cont...@catenacyber.fr> > Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> > --- > libavcodec/parser.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/libavcodec/parser.c b/libavcodec/parser.c > index efc28b8918..db39e698ab 100644 > --- a/libavcodec/parser.c > +++ b/libavcodec/parser.c > @@ -214,7 +214,7 @@ int ff_combine_frame(ParseContext *pc, int next, > for (; pc->overread > 0; pc->overread--) > pc->buffer[pc->index++] = pc->buffer[pc->overread_index++]; > > - if (next > *buf_size) > + if (next > *buf_size || (next < -pc->index && next != END_NOT_FOUND)) > return AVERROR(EINVAL); > > /* flush remaining if EOF */
Could you provide more details about this? E.g. which parser is this about at all? And how can we actually come in this situation at all? (Whenever I looked at ff_combine_frame() I do not really understand what its invariants are supposed to be.) - Andreas _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
