From 9711b527394c99e5bd4c5174a1a30a2238bbb859 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 10 Jul 2013 16:39:10 +0200 Subject: avfilter/af_earwax: Fix out of array accesses on odd packets Found-by: Paul B Mahol Signed-off-by: Michael Niedermayer (cherry picked from commit 0a3a0edd52b98aec27d1b8c63c85cb52ff46d40e) Signed-off-by: Michael Niedermayer --- libavfilter/af_earwax.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/libavfilter/af_earwax.c b/libavfilter/af_earwax.c index 189243a672..3db4659c35 100644 --- a/libavfilter/af_earwax.c +++ b/libavfilter/af_earwax.c @@ -114,6 +114,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples) AVFilterLink *outlink = inlink->dst->outputs[0]; int16_t *taps, *endin, *in, *out; AVFrame *outsamples = ff_get_audio_buffer(inlink, insamples->nb_samples); + int len; if (!outsamples) { av_frame_free(&insamples); @@ -125,16 +126,20 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples) out = (int16_t *)outsamples->data[0]; in = (int16_t *)insamples ->data[0]; + len = FFMIN(NUMTAPS, 2*insamples->nb_samples); // copy part of new input and process with saved input - memcpy(taps+NUMTAPS, in, NUMTAPS * sizeof(*taps)); - out = scalarproduct(taps, taps + NUMTAPS, out); + memcpy(taps+NUMTAPS, in, len * sizeof(*taps)); + out = scalarproduct(taps, taps + len, out); // process current input - endin = in + insamples->nb_samples * 2 - NUMTAPS; - scalarproduct(in, endin, out); - - // save part of input for next round - memcpy(taps, endin, NUMTAPS * sizeof(*taps)); + if (2*insamples->nb_samples >= NUMTAPS ){ + endin = in + insamples->nb_samples * 2 - NUMTAPS; + scalarproduct(in, endin, out); + + // save part of input for next round + memcpy(taps, endin, NUMTAPS * sizeof(*taps)); + } else + memmove(taps, taps + 2*insamples->nb_samples, NUMTAPS * sizeof(*taps)); av_frame_free(&insamples); return ff_filter_frame(outlink, outsamples); -- cgit v1.2.1