[FFmpeg-cvslog] lavf/utils.c Protect against accessing entries[nb_entries]

[Matt Wolenetz]

ffmpeg | branch: master | Matt Wolenetz <wolenetz at chromium.org> | Mon Nov 21 15:54:02 2016 -0800| [fe7547d69e6721d064c8604d0a6375a2d24b35ca] | committer: Michael Niedermayer

lavf/utils.c Protect against accessing entries[nb_entries]

In ff_index_search_timestamp(), if b == num_entries,
m == num_entries - 1, and entries[m].flags & AVINDEX_DISCARD_FRAME is
true, then the search for the next non-discarded packet could access
entries[nb_entries], exceeding its bounds. This change adds a protection
against that scenario. Reference: https://crbug.com/666770

Reviewed-by: Sasi Inguva <isasi at google.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fe7547d69e6721d064c8604d0a6375a2d24b35ca
---

 libavformat/utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/utils.c b/libavformat/utils.c
index 50a30f6..d5dfca7 100644
--- a/libavformat/utils.c
+++ b/libavformat/utils.c
@@ -1981,7 +1981,7 @@ int ff_index_search_timestamp(const AVIndexEntry *entries, int nb_entries,
         m         = (a + b) >> 1;
 
         // Search for the next non-discarded packet.
-        while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b) {
+        while ((entries[m].flags & AVINDEX_DISCARD_FRAME) && m < b && m < nb_entries - 1) {
             m++;
             if (m == b && entries[m].timestamp >= wanted_timestamp) {
                 m = b - 1;