Commit 6722e564 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/hdsenc: fix off by 1 error in array size check

Fixes CID1135763, CID1135764
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent d6c5fd9f
...@@ -89,7 +89,7 @@ static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size) ...@@ -89,7 +89,7 @@ static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size)
if (size > buf_size) if (size > buf_size)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (type == 8 || type == 9) { if (type == 8 || type == 9) {
if (os->nb_extra_packets > FF_ARRAY_ELEMS(os->extra_packets)) if (os->nb_extra_packets >= FF_ARRAY_ELEMS(os->extra_packets))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
os->extra_packet_sizes[os->nb_extra_packets] = size; os->extra_packet_sizes[os->nb_extra_packets] = size;
os->extra_packets[os->nb_extra_packets] = av_malloc(size); os->extra_packets[os->nb_extra_packets] = av_malloc(size);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment