[libav-commits] avidec: use actually read size instead of requested size

Anton Khirnov git at libav.org
Sat Sep 29 09:30:45 CEST 2012


Module: libav
Branch: master
Commit: 0af49a63c7f87876486ab09482d5b26b95abce60

Author:    Anton Khirnov <anton at khirnov.net>
Committer: Anton Khirnov <anton at khirnov.net>
Date:      Fri Sep 28 15:42:29 2012 +0200

avidec: use actually read size instead of requested size

Fixes CVE-2012-2788

---

 libavformat/avidec.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/libavformat/avidec.c b/libavformat/avidec.c
index b70367f..b2a06ed 100644
--- a/libavformat/avidec.c
+++ b/libavformat/avidec.c
@@ -1116,7 +1116,7 @@ resync:
             }
             ast->frame_offset += get_duration(ast, pkt->size);
         }
-        ast->remaining -= size;
+        ast->remaining -= err;
         if(!ast->remaining){
             avi->stream_index= -1;
             ast->packet_size= 0;



More information about the libav-commits mailing list