mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2024-12-25 00:32:31 +00:00
tm2: Fix overread of token array.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
11cc209226
commit
d0dafebb75
@ -339,8 +339,13 @@ static inline int GET_TOK(TM2Context *ctx,int type) {
|
||||
av_log(ctx->avctx, AV_LOG_ERROR, "Read token from stream %i out of bounds (%i>=%i)\n", type, ctx->tok_ptrs[type], ctx->tok_lens[type]);
|
||||
return 0;
|
||||
}
|
||||
if(type <= TM2_MOT)
|
||||
if(type <= TM2_MOT) {
|
||||
if (ctx->tokens[type][ctx->tok_ptrs[type]] >= TM2_DELTAS) {
|
||||
av_log(ctx->avctx, AV_LOG_ERROR, "token %d is too large\n", ctx->tokens[type][ctx->tok_ptrs[type]]);
|
||||
return 0;
|
||||
}
|
||||
return ctx->deltas[type][ctx->tokens[type][ctx->tok_ptrs[type]++]];
|
||||
}
|
||||
return ctx->tokens[type][ctx->tok_ptrs[type]++];
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user