Commit acb22f93 authored by Martin Boehme's avatar Martin Boehme Committed by Michael Niedermayer

Fix for overflow issue in mpegvideo.c patch by (Martin Boehme: boehme, inb uni-luebeck de)

this integer overflow might lead to the execution of arbitrary code during encoding with threads

Originally committed as revision 4474 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent d8cbeba1
......@@ -2316,8 +2316,8 @@ int MPV_encode_picture(AVCodecContext *avctx,
int start_y= s->thread_context[i]->start_mb_y;
int end_y= s->thread_context[i]-> end_mb_y;
int h= s->mb_height;
uint8_t *start= buf + buf_size*start_y/h;
uint8_t *end = buf + buf_size* end_y/h;
uint8_t *start= buf + (size_t)(((int64_t) buf_size)*start_y/h);
uint8_t *end = buf + (size_t)(((int64_t) buf_size)* end_y/h);
init_put_bits(&s->thread_context[i]->pb, start, end - start);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment