From 6722e564a82bac471d92b02550b5017c09b539ba Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 11 Dec 2013 20:17:23 +0100 Subject: [PATCH] avformat/hdsenc: fix off by 1 error in array size check Fixes CID1135763, CID1135764 Signed-off-by: Michael Niedermayer --- libavformat/hdsenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hdsenc.c b/libavformat/hdsenc.c index 7569b8f39c..6679a1795f 100644 --- a/libavformat/hdsenc.c +++ b/libavformat/hdsenc.c @@ -89,7 +89,7 @@ static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size) if (size > buf_size) return AVERROR_INVALIDDATA; if (type == 8 || type == 9) { - if (os->nb_extra_packets > FF_ARRAY_ELEMS(os->extra_packets)) + if (os->nb_extra_packets >= FF_ARRAY_ELEMS(os->extra_packets)) return AVERROR_INVALIDDATA; os->extra_packet_sizes[os->nb_extra_packets] = size; os->extra_packets[os->nb_extra_packets] = av_malloc(size);