matroskadec: fix out of bounds write
authorRonald S. Bultje <rsbultje@gmail.com>
Fri, 14 Oct 2011 22:03:55 +0000 (00:03 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 6 Nov 2011 18:49:12 +0000 (19:49 +0100)
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 723229c11f1400e6a09c8a1c9c27193f376eb1d1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d51c7b4cbe022f6b3b026735dc7e29eb50bbf129)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskadec.c

index d9ffec3..0d75c5c 100644 (file)
@@ -1641,7 +1641,7 @@ static int matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data,
                         lace_size[n] = lace_size[n - 1] + snum;
                         total += lace_size[n];
                     }
-                    lace_size[n] = size - total;
+                    lace_size[laces - 1] = size - total;
                     break;
                 }
             }