summaryrefslogtreecommitdiff
path: root/libavcodec/aacsbr.c
diff options
context:
space:
mode:
authorAlex Converse <alex.converse@gmail.com>2012-01-10 13:07:09 -0800
committerAlex Converse <alex.converse@gmail.com>2012-01-10 13:13:34 -0800
commit17ce52912f59a74ecc265e062578fb1181456e18 (patch)
treeba507744c514736ed3d980e63a79498b799ca339 /libavcodec/aacsbr.c
parent4556ebfb7d13f08eb8f794ac4fdfc04c89c46ece (diff)
downloadffmpeg-17ce52912f59a74ecc265e062578fb1181456e18.tar.gz
aacsbr: prevent out of bounds memcpy().
Fixes Libav Bug 195. This doesn't make the code handle sample rate or upsample/downsample change properly but this is still a good sanity check. Based on change by Michael Niedermayer. Signed-off-by: Alex Converse <alex.converse@gmail.com>
Diffstat (limited to 'libavcodec/aacsbr.c')
-rw-r--r--libavcodec/aacsbr.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c
index 81b0b4c001..0bfcabb06b 100644
--- a/libavcodec/aacsbr.c
+++ b/libavcodec/aacsbr.c
@@ -1181,14 +1181,15 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct,
{
int i, n;
const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us;
+ const int step = 128 >> div;
float *v;
for (i = 0; i < 32; i++) {
- if (*v_off == 0) {
+ if (*v_off < step) {
int saved_samples = (1280 - 128) >> div;
memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float));
- *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div);
+ *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - step;
} else {
- *v_off -= 128 >> div;
+ *v_off -= step;
}
v = v0 + *v_off;
if (div) {