Commit 9e66b39a authored by Andreas Cadhalpun's avatar Andreas Cadhalpun Committed by Michael Niedermayer

diracdec: avoid overflow of bytes*8 in decode_lowdelay

If bytes is large enough, bytes*8 can overflow and become negative.

In that case 'bufsize -= bytes*8' causes bufsize to increase instead of
decrease.

This leads to a segmentation fault.
Signed-off-by: 's avatarAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent af6739d6
......@@ -801,7 +801,10 @@ static int decode_lowdelay(DiracContext *s)
slice_num++;
buf += bytes;
bufsize -= bytes*8;
if (bufsize/8 >= bytes)
bufsize -= bytes*8;
else
bufsize = 0;
}
avctx->execute(avctx, decode_lowdelay_slice, slices, NULL, slice_num,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment