From b8ed15d6378f00e158c72c526fa0fce17da77361 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 11 Dec 2013 20:17:23 +0100 Subject: [PATCH] hdsenc: Fix an off by one error in an array size check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Martin Storsjö --- libavformat/hdsenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavformat/hdsenc.c b/libavformat/hdsenc.c index ea6e77c041..c0932933d4 100644 --- a/libavformat/hdsenc.c +++ b/libavformat/hdsenc.c @@ -89,7 +89,7 @@ static int parse_header(OutputStream *os, const uint8_t *buf, int buf_size) if (size > buf_size) return AVERROR_INVALIDDATA; if (type == 8 || type == 9) { - if (os->nb_extra_packets > FF_ARRAY_ELEMS(os->extra_packets)) + if (os->nb_extra_packets >= FF_ARRAY_ELEMS(os->extra_packets)) return AVERROR_INVALIDDATA; os->extra_packet_sizes[os->nb_extra_packets] = size; os->extra_packets[os->nb_extra_packets] = av_malloc(size);