Commit 56e71fe5 authored by Francois Cartegnie's avatar Francois Cartegnie

demux: asf: fix heap buffer write ofw in priorities (fix #12363)

parent e3aa96b9
...@@ -694,7 +694,7 @@ static void ASF_fillup_es_priorities_ex( demux_sys_t *p_sys, void *p_hdr, ...@@ -694,7 +694,7 @@ static void ASF_fillup_es_priorities_ex( demux_sys_t *p_sys, void *p_hdr,
/* Just set highest prio on highest in the group */ /* Just set highest prio on highest in the group */
for ( uint16_t i = 1; i < p_mutex->i_stream_number_count; i++ ) for ( uint16_t i = 1; i < p_mutex->i_stream_number_count; i++ )
{ {
if ( p_prios->i_count > p_sys->i_track ) break; if ( p_prios->i_count > p_sys->i_track || i > p_sys->i_track ) break;
p_prios->pi_stream_numbers[ p_prios->i_count++ ] = p_mutex->pi_stream_number[ i ]; p_prios->pi_stream_numbers[ p_prios->i_count++ ] = p_mutex->pi_stream_number[ i ];
} }
} }
...@@ -721,7 +721,7 @@ static void ASF_fillup_es_bitrate_priorities_ex( demux_sys_t *p_sys, void *p_hdr ...@@ -721,7 +721,7 @@ static void ASF_fillup_es_bitrate_priorities_ex( demux_sys_t *p_sys, void *p_hdr
/* Just remove < highest */ /* Just remove < highest */
for ( uint16_t i = 1; i < p_bitrate_mutex->i_stream_number_count; i++ ) for ( uint16_t i = 1; i < p_bitrate_mutex->i_stream_number_count; i++ )
{ {
if ( p_prios->i_count > p_sys->i_track ) break; if ( p_prios->i_count > p_sys->i_track || i > p_sys->i_track ) break;
p_prios->pi_stream_numbers[ p_prios->i_count++ ] = p_bitrate_mutex->pi_stream_numbers[ i ]; p_prios->pi_stream_numbers[ p_prios->i_count++ ] = p_bitrate_mutex->pi_stream_numbers[ i ];
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment