diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-06-30 16:11:29 +0400 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-06-30 16:11:29 +0400 |
| commit | 8d8409ca9ffd56eea6a8ae1963c15492a75af0bd (patch) | |
| tree | 32abc39d37c5985fb998e9cea1c999d08ea241dd /libavcodec/h264.c | |
| parent | 0444a8c534545e9d2d6c82f815bf2135b4a55836 (diff) | |
Fix nalsize check to avoid an integer overflow that made the check
incorrect for nalsize > INT_MAX - buf_index
Originally committed as revision 19307 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/h264.c')
| -rw-r--r-- | libavcodec/h264.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/h264.c b/libavcodec/h264.c index 40ba4eb955..9cdac24605 100644 --- a/libavcodec/h264.c +++ b/libavcodec/h264.c @@ -7505,7 +7505,7 @@ static int decode_nal_units(H264Context *h, const uint8_t *buf, int buf_size){ nalsize = 0; for(i = 0; i < h->nal_length_size; i++) nalsize = (nalsize << 8) | buf[buf_index++]; - if(nalsize <= 1 || (nalsize+buf_index > buf_size)){ + if(nalsize <= 1 || nalsize > buf_size - buf_index){ if(nalsize == 1){ buf_index++; continue; |