lavc/videotoolbox: fix out-of-bounds memory access during hvcc creation

Aman Gupta committed 9 years ago

Commit 05d77581 parent d0920da1 file · +2 −2Browse files

Unified · Split

libavcodec/videotoolbox.c+2−2

@@ -131,7 +131,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx) · 130 unmodified lines
131	131	int vt_extradata_size = 23 + 5 + vps->data_size + 5 + sps->data_size + 3;
132	132	uint8_t *vt_extradata;
133	133
134		− for (i = 0; i < MAX_PPS_COUNT; i++) {
	134	+ for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) {
135	135	if (h->ps.pps_list[i]) {
136	136	const HEVCPPS pps = (const HEVCPPS )h->ps.pps_list[i]->data;
137	137	vt_extradata_size += 2 + pps->data_size;
@@ -258,7 +258,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx) · 120 unmodified lines
258	258	HEVC_NAL_PPS & 0x3f);
259	259	AV_WB16(p + 1, num_pps);
260	260	p += 3;
261		− for (i = 0; i < MAX_PPS_COUNT; i++) {
	261	+ for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) {
262	262	if (h->ps.pps_list[i]) {
263	263	const HEVCPPS pps = (const HEVCPPS )h->ps.pps_list[i]->data;
264	264	AV_WB16(p, pps->data_size);