| From c17a0ad1df15a94d0b1239adc2afb593bdf0a153 Mon Sep 17 00:00:00 2001 |
| From: Michael Niedermayer <michaelni@gmx.at> |
| Date: Fri, 3 Oct 2014 22:50:45 +0200 |
| Subject: [PATCH 1/2] avcodec/smc: fix off by 1 error |
| |
| Upstream-Status: Backport |
| |
| Fixes out of array access |
| Fixes: asan_heap-oob_1685bf0_5_asan_heap-oob_1f35116_430_smc.mov |
| |
| Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind |
| Signed-off-by: Michael Niedermayer <michaelni@gmx.at> |
| --- |
| libavcodec/smc.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/gst-libs/ext/libav/libavcodec/smc.c b/gst-libs/ext/libav/libavcodec/smc.c |
| index 3cd5e53..dec9f71 100644 |
| --- a/gst-libs/ext/libav/libavcodec/smc.c |
| +++ b/gst-libs/ext/libav/libavcodec/smc.c |
| @@ -69,7 +69,7 @@ typedef struct SmcContext { |
| row_ptr += stride * 4; \ |
| } \ |
| total_blocks--; \ |
| - if (total_blocks < 0) \ |
| + if (total_blocks < 0 + !!n_blocks) \ |
| { \ |
| av_log(s->avctx, AV_LOG_INFO, "warning: block counter just went negative (this should not happen)\n"); \ |
| return; \ |
| -- |
| 2.1.0 |
| |