lag_read_prob_header: fix out of array access
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 10 Nov 2012 18:38:44 +0000 (19:38 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 10 Nov 2012 18:39:05 +0000 (19:39 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/lagarith.c

index 6af0d09..0611abf 100644 (file)
@@ -158,8 +158,8 @@ static int lag_read_prob_header(lag_rac *rac, GetBitContext *gb)
                 av_log(rac->avctx, AV_LOG_ERROR, "Invalid probability run encountered.\n");
                 return -1;
             }
-            if (prob > 257 - i)
-                prob = 257 - i;
+            if (prob > 256 - i)
+                prob = 256 - i;
             for (j = 0; j < prob; j++)
                 rac->prob[++i] = 0;
         }