diff options
author | Aurelien Jacobs <aurel@gnuage.org> | 2011-01-03 02:40:30 +0300 |
---|---|---|
committer | Aurelien Jacobs <aurel@gnuage.org> | 2011-01-03 02:40:30 +0300 |
commit | f5dd1eb7b5441cf65e9b68c51717d489fc21b155 (patch) | |
tree | ca0fb112f3ba83ad8d10082e170db12309f2a4d6 /libavcodec | |
parent | 6734f2c89e6afd95f8593e8c99ae43e12fe9fee4 (diff) |
srtdec: ensure we don't read 1 byte after buffer end if the buffer is not
properly terminated.
Originally committed as revision 26201 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/srtdec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/srtdec.c b/libavcodec/srtdec.c index 42eae322d1..adbae514c7 100644 --- a/libavcodec/srtdec.c +++ b/libavcodec/srtdec.c @@ -65,7 +65,7 @@ static const char *srt_to_ass(AVCodecContext *avctx, char *out, char *out_end, out += snprintf(out, out_end-out, "{\\an1}{\\pos(%d,%d)}", x1, y1); } - for (; *in && out < out_end && !end; in++) { + for (; out < out_end && !end && *in; in++) { switch (*in) { case '\r': break; @@ -211,13 +211,14 @@ static int srt_decode_frame(AVCodecContext *avctx, int ts_start, ts_end, x1 = -1, y1 = -1, x2 = -1, y2 = -1; char buffer[2048]; const char *ptr = avpkt->data; + const char *end = avpkt->data + avpkt->size; if (avpkt->size <= 0) return avpkt->size; ff_ass_init(sub); - while (*ptr) { + while (ptr < end && *ptr) { ptr = read_ts(ptr, &ts_start, &ts_end, &x1, &y1, &x2, &y2); if (!ptr) break; |