rtmpproto: Fix an out of array write
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 12 Oct 2012 00:06:51 +0000 (02:06 +0200)
committerMartin Storsjö <martin@martin.st>
Fri, 12 Oct 2012 15:16:59 +0000 (18:16 +0300)
Signed-off-by: Martin Storsjö <martin@martin.st>
libavformat/rtmpproto.c

index a5bc246e31b4ce8553e88c9e4586dba7d8f07d2c..3ab2e57e6220f368d0f5578575dcb64a669ffd27 100644 (file)
@@ -1371,9 +1371,9 @@ static int rtmp_server_handshake(URLContext *s, RTMPContext *rt)
     /* By now same epoch will be sent */
     hs_my_epoch = hs_epoch;
     /* Generate random */
-    for (randomidx = 0; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE);
+    for (randomidx = 8; randomidx < (RTMP_HANDSHAKE_PACKET_SIZE);
          randomidx += 4)
-        AV_WB32(hs_s1 + 8 + randomidx, av_get_random_seed());
+        AV_WB32(hs_s1 + randomidx, av_get_random_seed());
 
     ret = rtmp_send_hs_packet(rt, hs_my_epoch, 0, hs_s1,
                               RTMP_HANDSHAKE_PACKET_SIZE);