Browse Source

proresdec: Fix read via negative index in a global array.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n0.11
Michael Niedermayer 13 years ago
parent
commit
0065080320
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      libavcodec/proresdec2.c

+ 1
- 1
libavcodec/proresdec2.c View File

@@ -302,7 +302,7 @@ static av_always_inline void decode_dc_coeffs(GetBitContext *gb, DCTELEM *out,
code = 5;
sign = 0;
for (i = 1; i < blocks_per_slice; i++, out += 64) {
DECODE_CODEWORD(code, dc_codebook[FFMIN(code, 6)]);
DECODE_CODEWORD(code, dc_codebook[FFMIN(code, 6U)]);
if(code) sign ^= -(code & 1);
else sign = 0;
prev_dc += (((code + 1) >> 1) ^ sign) - sign;


Loading…
Cancel
Save