| author | Michael Niedermayer <michaelni@gmx.at> | 2013-10-21 14:21:14 (GMT) |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-10-21 14:43:25 (GMT) |
| commit | ab2bfb85d49b2f8aa505816f93e75fd18ad0a361 (patch) | |
| tree | 5b23d867a581a57dfe9abf8158d5627dafa874da | |
| parent | c65521693914aed1c9fe42a2d6aebbde667fac79 (diff) | |
| download | ffmpeg-ab2bfb85d49b2f8aa505816f93e75fd18ad0a361.zip ffmpeg-ab2bfb85d49b2f8aa505816f93e75fd18ad0a361.tar.gz ffmpeg-ab2bfb85d49b2f8aa505816f93e75fd18ad0a361.tar.bz2 | |
avfilter/ff_insert_pad: fix order of operations
Fixes out of bounds access
Fixes CID732170
Fixes CID732169
No filter is known to use this function in a way so the issue can be reproduced.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavfilter/avfilter.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavfilter/avfilter.c b/libavfilter/avfilter.c index 7ce82f8..f31968f 100644 --- a/libavfilter/avfilter.c +++ b/libavfilter/avfilter.c @@ -119,8 +119,8 @@ int ff_insert_pad(unsigned idx, unsigned *count, size_t padidx_off, (*count)++; for (i = idx + 1; i < *count; i++) - if (*links[i]) - (*(unsigned *)((uint8_t *) *links[i] + padidx_off))++; + if ((*links)[i]) + (*(unsigned *)((uint8_t *) (*links)[i] + padidx_off))++; return 0; } |