package/mpp
1
0
Fork 0
mirror of https://github.com/nyanmisaka/mpp.git synced 2025-11-02 13:34:04 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

[mpeg4d]: Fix crash of stack overflow

Browse Source 
bug: tmp[i] = 0 --> tmp[256] = 0

Change-Id: Iff3a6f5b78413358d0793ea48eaa9142e8781143
Signed-off-by: shine.liu <shine.liu@rock-chips.com>
This commit is contained in:
shine.liu
2022-07-12 09:52:53 +08:00
parent 3d282d8200
commit 797536f816
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mpp/codec/dec/mpg4/mpg4d_parser.c
View File

@@ -703,7 +703,7 @@ static MPP_RET mpg4d_parse_user_data(Mpg4dParserImpl *p, BitReadCtx_t *gb)
memset(tmp, 0, 256);
for (i = 0; i < 256 && gb->bytes_left_; i++) {
for (i = 0; i < 255 && gb->bytes_left_; i++) {
RK_U32 show_bit = MPP_MIN(remain_bit, 23);
RK_U32 val;
@@ -716,6 +716,10 @@ static MPP_RET mpg4d_parse_user_data(Mpg4dParserImpl *p, BitReadCtx_t *gb)
remain_bit -= 8;
}
/*
* The value of i in the for loop above must be less than 255 otherwise it will cause
* tmp [256] = 0 which is overflow
*/
tmp[i] = 0;
if (!mp4Hdr->usr.packed_mode) {