From 1e9e311e21074575f1ad29fb35ac135197f4b68d Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Mon, 5 Aug 2013 22:15:24 +0200 Subject: [PATCH] dv: Add a guard to not overread the ppcm array Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 7ee191cab0dc44700f26c5784e2adeb6a779651b) Signed-off-by: Luca Barbato Conflicts: libavformat/dv.c --- libavformat/dv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/dv.c b/libavformat/dv.c index 1730972213..ea2805e630 100644 --- a/libavformat/dv.c +++ b/libavformat/dv.c @@ -108,7 +108,7 @@ static const int dv_audio_frequency[3] = { * 3. Audio is always returned as 16bit linear samples: 12bit nonlinear samples * are converted into 16bit linear ones. */ -static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4], +static int dv_extract_audio(uint8_t *frame, uint8_t **ppcm, const DVprofile *sys) { int size, chan, i, j, d, of, smpls, freq, quant, half_ch; @@ -336,7 +336,7 @@ int avpriv_dv_produce_packet(DVDemuxContext *c, AVPacket *pkt, uint8_t* buf, int buf_size) { int size, i; - uint8_t *ppcm[4] = {0}; + uint8_t *ppcm[5] = { 0 }; if (buf_size < DV_PROFILE_BYTES || !(c->sys = avpriv_dv_frame_profile(c->sys, buf, buf_size)) ||