diff options
author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2007-02-06 18:30:56 +0000 |
---|---|---|
committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2007-02-06 18:30:56 +0000 |
commit | c8e55fd4bcfa0fe166c8d016092aafefd89a9636 (patch) | |
tree | c18dfe51a6949f09a807cda70096bd7f38a08cde | |
parent | fad5b594436e3b54de3fcd4e94ddc5e6fc9791aa (diff) | |
download | mpv-c8e55fd4bcfa0fe166c8d016092aafefd89a9636.tar.bz2 mpv-c8e55fd4bcfa0fe166c8d016092aafefd89a9636.tar.xz |
Add missing checks in RealVideo slice handling code.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@22165 b3059339-0415-0410-9bf9-f77b7e298cf2
-rw-r--r-- | libmpcodecs/vd_ffmpeg.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libmpcodecs/vd_ffmpeg.c b/libmpcodecs/vd_ffmpeg.c index dfd215c986..1e710d54f0 100644 --- a/libmpcodecs/vd_ffmpeg.c +++ b/libmpcodecs/vd_ffmpeg.c @@ -764,15 +764,17 @@ static mp_image_t* decode(sh_video_t *sh,void* data,int len,int flags){ if(sh->bih->biSize>=sizeof(*sh->bih)+8){ int i; dp_hdr_t *hdr= (dp_hdr_t*)data; + uint32_t *offsets = (uint32_t*)(data + hdr->chunktab) + 1; + char *end = data + len; if(avctx->slice_offset==NULL) avctx->slice_offset= av_malloc(sizeof(int)*1000); // for(i=0; i<25; i++) printf("%02X ", ((uint8_t*)data)[i]); - avctx->slice_count= hdr->chunks+1; - for(i=0; i<avctx->slice_count; i++) - avctx->slice_offset[i]= ((uint32_t*)(data+hdr->chunktab))[2*i+1]; + avctx->slice_count= FFMIN(hdr->chunks+1, 1000); + for(i=0; i<avctx->slice_count && end >= &offsets[2*i+1]; i++) + avctx->slice_offset[i]= offsets[2*i]; len=hdr->len; data+= sizeof(dp_hdr_t); } |