Commit c3abb59f authored by Nickolai Zeldovich's avatar Nickolai Zeldovich Committed by Rafaël Carré

modules/packetizer/dirac.c: check index before dereferencing

Check that frame_rate_index is within bounds before dereferencing
the dirac_frate_tbl[] array.
Signed-off-by: default avatarRafaël Carré <funman@videolan.org>
parent 10706d0f
...@@ -571,13 +571,13 @@ static bool dirac_UnpackSeqHdr( struct seq_hdr_t *p_sh, block_t *p_block ) ...@@ -571,13 +571,13 @@ static bool dirac_UnpackSeqHdr( struct seq_hdr_t *p_sh, block_t *p_block )
if( dirac_bool( &bs ) ) if( dirac_bool( &bs ) )
{ {
uint32_t frame_rate_index = dirac_uint( &bs ); uint32_t frame_rate_index = dirac_uint( &bs );
p_sh->u_fps_num = dirac_frate_tbl[frame_rate_index].u_n;
p_sh->u_fps_den = dirac_frate_tbl[frame_rate_index].u_d;
if( frame_rate_index >= dirac_frate_tbl_size ) if( frame_rate_index >= dirac_frate_tbl_size )
{ {
/* invalid header */ /* invalid header */
return false; return false;
} }
p_sh->u_fps_num = dirac_frate_tbl[frame_rate_index].u_n;
p_sh->u_fps_den = dirac_frate_tbl[frame_rate_index].u_d;
if( frame_rate_index == 0 ) if( frame_rate_index == 0 )
{ {
p_sh->u_fps_num = dirac_uint( &bs ); /* frame_rate_numerator */ p_sh->u_fps_num = dirac_uint( &bs ); /* frame_rate_numerator */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment