From 05d77587cb7d0a4e349c5320eb7c0b48610cf6bf Mon Sep 17 00:00:00 2001 From: Aman Gupta Date: Tue, 31 Oct 2017 16:21:33 -0700 Subject: [PATCH] lavc/videotoolbox: fix out-of-bounds memory access during hvcc creation Signed-off-by: Aman Gupta --- libavcodec/videotoolbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/videotoolbox.c b/libavcodec/videotoolbox.c index 3bdc1f7d1f..ecb2502c1f 100644 --- a/libavcodec/videotoolbox.c +++ b/libavcodec/videotoolbox.c @@ -131,7 +131,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx) int vt_extradata_size = 23 + 5 + vps->data_size + 5 + sps->data_size + 3; uint8_t *vt_extradata; - for (i = 0; i < MAX_PPS_COUNT; i++) { + for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) { if (h->ps.pps_list[i]) { const HEVCPPS *pps = (const HEVCPPS *)h->ps.pps_list[i]->data; vt_extradata_size += 2 + pps->data_size; @@ -258,7 +258,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx) HEVC_NAL_PPS & 0x3f); AV_WB16(p + 1, num_pps); p += 3; - for (i = 0; i < MAX_PPS_COUNT; i++) { + for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) { if (h->ps.pps_list[i]) { const HEVCPPS *pps = (const HEVCPPS *)h->ps.pps_list[i]->data; AV_WB16(p, pps->data_size);