mpegvideo_parser: fix buffer access beyond end

[ffmpeg] / libavcodec / ratecontrol.c

diff --git a/libavcodec/ratecontrol.c b/libavcodec/ratecontrol.c
index 8f8647c058e2489eb6fe3243a2cdda8f09677952..59f69a27a8e13fb6481443617d96aaf6de369b23 100644 (file)
--- a/libavcodec/ratecontrol.c
+++ b/libavcodec/ratecontrol.c
@@ -112,7 +112,7 @@ int ff_rate_control_init(MpegEncContext *s)
 
     if (!s->avctx->rc_max_available_vbv_use && s->avctx->rc_buffer_size) {
         if (s->avctx->rc_max_rate) {
-            s->avctx->rc_max_available_vbv_use = av_clipf(s->avctx->rc_max_rate/(s->avctx->rc_buffer_size*get_fps(s->avctx)), 1.0/0.3, 1.0);
+            s->avctx->rc_max_available_vbv_use = av_clipf(s->avctx->rc_max_rate/(s->avctx->rc_buffer_size*get_fps(s->avctx)), 1.0/3, 1.0);
         } else
             s->avctx->rc_max_available_vbv_use = 1.0;
     }
@@ -691,7 +691,10 @@ float ff_rate_estimate_qscale(MpegEncContext *s, int dry_run)
 
     if(s->flags&CODEC_FLAG_PASS2){
         assert(picture_number>=0);
-        assert(picture_number<rcc->num_entries);
+        if(picture_number >= rcc->num_entries) {
+            av_log(s, AV_LOG_ERROR, "Input is longer than 2-pass log file\n");
+            return -1;
+        }
         rce= &rcc->entry[picture_number];
         wanted_bits= rce->expected_bits;
     }else{