Fix out of bound writes in fix_bitshift() of the shorten decoder.
authorLaurent Aimar <fenrir@videolan.org>
Thu, 29 Sep 2011 22:05:53 +0000 (00:05 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 30 Sep 2011 02:14:23 +0000 (04:14 +0200)
The data pointers s->decoded[*] already take into account s->nwrap.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/shorten.c

index b39fcbd..f46b21f 100644 (file)
@@ -155,7 +155,7 @@ static void fix_bitshift(ShortenContext *s, int32_t *buffer)
 
     if (s->bitshift != 0)
         for (i = 0; i < s->blocksize; i++)
-            buffer[s->nwrap + i] <<= s->bitshift;
+            buffer[i] <<= s->bitshift;
 }