har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avfilter/af_earwax: Fix out of array accesses on odd packets

Browse Source 
Found-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-07-10 16:39:10 +02:00
parent 8f09957194
commit 0a3a0edd52
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavfilter/af_earwax.c
View File

@ -114,6 +114,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples)
AVFilterLink *outlink = inlink->dst->outputs[0];
int16_t *taps, *endin, *in, *out;
AVFrame *outsamples = ff_get_audio_buffer(inlink, insamples->nb_samples);
int len;
if (!outsamples) {
av_frame_free(&insamples);
@ -125,16 +126,20 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples)
out = (int16_t *)outsamples->data[0];
in = (int16_t *)insamples ->data[0];
len = FFMIN(NUMTAPS, 2*insamples->nb_samples);
// copy part of new input and process with saved input
memcpy(taps+NUMTAPS, in, NUMTAPS * sizeof(*taps));
out = scalarproduct(taps, taps + NUMTAPS, out);
memcpy(taps+NUMTAPS, in, len * sizeof(*taps));
out = scalarproduct(taps, taps + len, out);
// process current input
endin = in + insamples->nb_samples * 2 - NUMTAPS;
scalarproduct(in, endin, out);
if (2*insamples->nb_samples >= NUMTAPS ){
endin = in + insamples->nb_samples * 2 - NUMTAPS;
scalarproduct(in, endin, out);
// save part of input for next round
memcpy(taps, endin, NUMTAPS * sizeof(*taps));
// save part of input for next round
memcpy(taps, endin, NUMTAPS * sizeof(*taps));
} else
memmove(taps, taps + 2*insamples->nb_samples, NUMTAPS * sizeof(*taps));
av_frame_free(&insamples);
return ff_filter_frame(outlink, outsamples);