[FFmpeg-devel] [PATCH] rawdec: fix mjpeg probing buffer size check

wm4 nfxjfg at googlemail.com
Wed Jul 29 22:33:44 CEST 2015


---
If I read this right, the subtraction and comparison would be done in
unsigned, because size_t is unsigned. Which would make this check
ineffective. (p->buf_size is int.)
---
 libavformat/rawdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavformat/rawdec.c b/libavformat/rawdec.c
index caa209f..7684e1d 100644
--- a/libavformat/rawdec.c
+++ b/libavformat/rawdec.c
@@ -191,7 +191,7 @@ static int mjpeg_probe(AVProbeData *p)
         static const char ct_jpeg[] = "\r\nContent-Type: image/jpeg\r\n";
         int i;
 
-        for (i=0; i<FFMIN(p->buf_size - sizeof(ct_jpeg), 100); i++)
+        for (i=0; i<FFMIN(p->buf_size - (int)sizeof(ct_jpeg), 100); i++)
             if (!memcmp(p->buf + i, ct_jpeg, sizeof(ct_jpeg) - 1))
                 return AVPROBE_SCORE_EXTENSION;
 
-- 
2.4.6



More information about the ffmpeg-devel mailing list