diff options
| author | Yuriy Kaminskiy <yumkam@mail.ru> | 2010-11-06 23:26:49 +0000 |
|---|---|---|
| committer | Martin Storsjö <martin@martin.st> | 2010-11-06 23:26:49 +0000 |
| commit | c77549c510370eaaa2e2bb1f15d1a30f29e30950 (patch) | |
| tree | 3d49ff307967ef16d64bdc5ec9783f147663e117 /libavformat | |
| parent | c4d5ee233abcce9159b699f4e695db96864f2b00 (diff) | |
| download | ffmpeg-c77549c510370eaaa2e2bb1f15d1a30f29e30950.tar.gz | |
rtsp: Set the real_setup pointer properly, avoid out of bounds memory accesses
This fixes a regression since svn rev 24752, where the real_setup pointer
was set incorrectly. The arithmetic with the real_setup_cache pointer
is in units of enum AVDiscard, so the sizeof multiplication should be removed.
Patch by Yuriy Kaminskiy, yumkam at mail dot ru.
Originally committed as revision 25684 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/rtspdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/rtspdec.c b/libavformat/rtspdec.c index d2f49a41fa..fd74b08c53 100644 --- a/libavformat/rtspdec.c +++ b/libavformat/rtspdec.c @@ -136,7 +136,7 @@ static int rtsp_read_header(AVFormatContext *s, rt->real_setup_cache = av_mallocz(2 * s->nb_streams * sizeof(*rt->real_setup_cache)); if (!rt->real_setup_cache) return AVERROR(ENOMEM); - rt->real_setup = rt->real_setup_cache + s->nb_streams * sizeof(*rt->real_setup); + rt->real_setup = rt->real_setup_cache + s->nb_streams; if (ap->initial_pause) { /* do not start immediately */ |