• Andreas Cadhalpun's avatar
    apedec: prevent out of array writes in decode_array_0000 · 699341d6
    Andreas Cadhalpun authored
    s->decoded_buffer is allocated with a min_size of:
        2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer)
    
    Then it is assigned to s->decoded[0] (and s->decoded_buffer + FFALIGN(blockstodecode, 8)
    to s->decoded[1]) and passed as out buffer to decode_array_0000.
    
    In this function 64 elements of the out buffer are written
    unconditionally and outside the array if blockstodecode is too small.
    
    This causes memory corruption, leading to segmentation faults or other
    crashes.
    
    Thus change decode_array_0000 to write at most blockstodecode elements
    of the out buffer.
    Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
    Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
    699341d6
apedec.c 50 KB