avformat/matroskadec: fix off by 1 error in matroska_read_seek()
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 30 May 2014 03:21:24 +0000 (05:21 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 30 May 2014 11:55:03 +0000 (13:55 +0200)
Fixes out of array read

Fixes: vp9-opus-crash.webm

Found-by: Dale Curtis <dalecurtis@google.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskadec.c

index 65847fa..213767c 100644 (file)
@@ -3018,7 +3018,7 @@ static int matroska_read_seek(AVFormatContext *s, int stream_index,
                 tracks[i].stream, st->index_entries[index].timestamp,
                 AVSEEK_FLAG_BACKWARD);
             while (index_sub >= 0 &&
-                  index_min >= 0 &&
+                  index_min > 0 &&
                   tracks[i].stream->index_entries[index_sub].pos < st->index_entries[index_min].pos &&
                   st->index_entries[index].timestamp - tracks[i].stream->index_entries[index_sub].timestamp < 30000000000 / matroska->time_scale)
                 index_min--;