diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2008-03-04 21:39:21 +0000 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2008-03-04 21:39:21 +0000 |
commit | 1a2a1d90775b5be03254d123e4b617145a269572 (patch) | |
tree | 0c0189ab1f0c50fef846c07df2600a4520107a5a | |
parent | 79989881297f37e0795c8bcbc9f7d7df8308b959 (diff) | |
download | ffmpeg-streaming-1a2a1d90775b5be03254d123e4b617145a269572.zip ffmpeg-streaming-1a2a1d90775b5be03254d123e4b617145a269572.tar.gz |
Prevent segfault due to reading over the end of the input buffer.
Originally committed as revision 12315 to svn://svn.ffmpeg.org/ffmpeg/trunk
-rw-r--r-- | libavcodec/apedec.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavcodec/apedec.c b/libavcodec/apedec.c index 032bc73..915a2f3 100644 --- a/libavcodec/apedec.c +++ b/libavcodec/apedec.c @@ -256,7 +256,10 @@ static inline void range_start_decoding(APEContext * ctx) static inline void range_dec_normalize(APEContext * ctx) { while (ctx->rc.range <= BOTTOM_VALUE) { - ctx->rc.buffer = (ctx->rc.buffer << 8) | bytestream_get_byte(&ctx->ptr); + ctx->rc.buffer <<= 8; + if(ctx->ptr < ctx->data_end) + ctx->rc.buffer += *ctx->ptr; + ctx->ptr++; ctx->rc.low = (ctx->rc.low << 8) | ((ctx->rc.buffer >> 1) & 0xFF); ctx->rc.range <<= 8; } |