diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-10 16:39:10 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-07-10 19:07:50 +0200 |
commit | 9711b527394c99e5bd4c5174a1a30a2238bbb859 (patch) | |
tree | 64a1ad473da078046ddb302ff61758ff7427c9f0 | |
parent | 2b8b2ba19fe0ca6594cb09439b9ead2c328a79d8 (diff) | |
download | ffmpeg-9711b527394c99e5bd4c5174a1a30a2238bbb859.tar.gz |
avfilter/af_earwax: Fix out of array accesses on odd packets
Found-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0a3a0edd52b98aec27d1b8c63c85cb52ff46d40e)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavfilter/af_earwax.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/libavfilter/af_earwax.c b/libavfilter/af_earwax.c index 189243a672..3db4659c35 100644 --- a/libavfilter/af_earwax.c +++ b/libavfilter/af_earwax.c @@ -114,6 +114,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples) AVFilterLink *outlink = inlink->dst->outputs[0]; int16_t *taps, *endin, *in, *out; AVFrame *outsamples = ff_get_audio_buffer(inlink, insamples->nb_samples); + int len; if (!outsamples) { av_frame_free(&insamples); @@ -125,16 +126,20 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples) out = (int16_t *)outsamples->data[0]; in = (int16_t *)insamples ->data[0]; + len = FFMIN(NUMTAPS, 2*insamples->nb_samples); // copy part of new input and process with saved input - memcpy(taps+NUMTAPS, in, NUMTAPS * sizeof(*taps)); - out = scalarproduct(taps, taps + NUMTAPS, out); + memcpy(taps+NUMTAPS, in, len * sizeof(*taps)); + out = scalarproduct(taps, taps + len, out); // process current input - endin = in + insamples->nb_samples * 2 - NUMTAPS; - scalarproduct(in, endin, out); - - // save part of input for next round - memcpy(taps, endin, NUMTAPS * sizeof(*taps)); + if (2*insamples->nb_samples >= NUMTAPS ){ + endin = in + insamples->nb_samples * 2 - NUMTAPS; + scalarproduct(in, endin, out); + + // save part of input for next round + memcpy(taps, endin, NUMTAPS * sizeof(*taps)); + } else + memmove(taps, taps + 2*insamples->nb_samples, NUMTAPS * sizeof(*taps)); av_frame_free(&insamples); return ff_filter_frame(outlink, outsamples); |