matroskaenc: fix cue tracknum off by 1 error
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 23 Feb 2013 22:05:44 +0000 (23:05 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 23 Feb 2013 22:06:27 +0000 (23:06 +0100)
Fixes out of array accesses

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/matroskaenc.c

index 4fbb410..4544f8e 100644 (file)
@@ -407,9 +407,11 @@ static int64_t mkv_write_cues(AVIOContext *pb, mkv_cues *cues, mkv_track *tracks
         for (j = 0; j < num_tracks; j++)
             tracks[j].has_cue = 0;
         for (j = 0; j < cues->num_entries - i && entry[j].pts == pts; j++) {
-            if (tracks[entry[j].tracknum].has_cue)
+            int tracknum = entry[j].tracknum - 1;
+            av_assert0(tracknum>=0 && tracknum<num_tracks);
+            if (tracks[tracknum].has_cue)
                 continue;
-            tracks[entry[j].tracknum].has_cue = 1;
+            tracks[tracknum].has_cue = 1;
             track_positions = start_ebml_master(pb, MATROSKA_ID_CUETRACKPOSITION, MAX_CUETRACKPOS_SIZE);
             put_ebml_uint(pb, MATROSKA_ID_CUETRACK          , entry[j].tracknum   );
             put_ebml_uint(pb, MATROSKA_ID_CUECLUSTERPOSITION, entry[j].cluster_pos);