lavc/videotoolbox: fix out-of-bounds memory access during hvcc creation

Aman Gupta committed 9 years ago

Commit 05d77581 parent d0920da1 file · +2 −2Browse files

Unified · Split

libavcodec/videotoolbox.c+2−2

@@ -131,7 +131,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx) · 130 unmodified lines
131	int vt_extradata_size = 23 + 5 + vps->data_size + 5 + sps->data_size + 3;	131	int vt_extradata_size = 23 + 5 + vps->data_size + 5 + sps->data_size + 3;
132	uint8_t *vt_extradata;	132	uint8_t *vt_extradata;
133		133
134	for (i = 0; i < MAX_PPS_COUNT; i++) {	134	for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) {
135	if (h->ps.pps_list[i]) {	135	if (h->ps.pps_list[i]) {
136	const HEVCPPS pps = (const HEVCPPS )h->ps.pps_list[i]->data;	136	const HEVCPPS pps = (const HEVCPPS )h->ps.pps_list[i]->data;
137	vt_extradata_size += 2 + pps->data_size;	137	vt_extradata_size += 2 + pps->data_size;
@@ -258,7 +258,7 @@ CFDataRef ff_videotoolbox_hvcc_extradata_create(AVCodecContext *avctx) · 120 unmodified lines
258	HEVC_NAL_PPS & 0x3f);	258	HEVC_NAL_PPS & 0x3f);
259	AV_WB16(p + 1, num_pps);	259	AV_WB16(p + 1, num_pps);
260	p += 3;	260	p += 3;
261	for (i = 0; i < MAX_PPS_COUNT; i++) {	261	for (i = 0; i < HEVC_MAX_PPS_COUNT; i++) {
262	if (h->ps.pps_list[i]) {	262	if (h->ps.pps_list[i]) {
263	const HEVCPPS pps = (const HEVCPPS )h->ps.pps_list[i]->data;	263	const HEVCPPS pps = (const HEVCPPS )h->ps.pps_list[i]->data;
264	AV_WB16(p, pps->data_size);	264	AV_WB16(p, pps->data_size);