mvdec: Check the frame counter against the correct limit.

fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-27 02:08:22 +01:00
parent 6512405ce2
commit 362271d72f

View File

@ -372,7 +372,7 @@ static int mv_read_packet(AVFormatContext *avctx, AVPacket *pkt)
int ret;
uint64_t pos;
if (frame < st->nb_frames) {
if (frame < st->nb_index_entries) {
index = &st->index_entries[frame];
pos = avio_tell(pb);
if (index->pos > pos)