Browse code

avfilter/af_earwax: Fix out of array accesses on odd packets

Found-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0a3a0edd52b98aec27d1b8c63c85cb52ff46d40e)

Conflicts:

libavfilter/af_earwax.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2013/07/10 23:39:10
Showing 1 changed files
... ...
@@ -117,6 +117,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *insamples)
117 117
         ff_get_audio_buffer(inlink, AV_PERM_WRITE,
118 118
                                   insamples->audio->nb_samples);
119 119
     int ret;
120
+    int len;
120 121
 
121 122
     if (!outsamples)
122 123
         return AVERROR(ENOMEM);
... ...
@@ -126,16 +127,20 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *insamples)
126 126
     out   = (int16_t *)outsamples->data[0];
127 127
     in    = (int16_t *)insamples ->data[0];
128 128
 
129
+    len = FFMIN(NUMTAPS, 2*insamples->audio->nb_samples);
129 130
     // copy part of new input and process with saved input
130
-    memcpy(taps+NUMTAPS, in, NUMTAPS * sizeof(*taps));
131
-    out   = scalarproduct(taps, taps + NUMTAPS, out);
131
+    memcpy(taps+NUMTAPS, in, len * sizeof(*taps));
132
+    out   = scalarproduct(taps, taps + len, out);
132 133
 
133 134
     // process current input
134
-    endin = in + insamples->audio->nb_samples * 2 - NUMTAPS;
135
-    scalarproduct(in, endin, out);
136
-
137
-    // save part of input for next round
138
-    memcpy(taps, endin, NUMTAPS * sizeof(*taps));
135
+    if (2*insamples->audio->nb_samples >= NUMTAPS ){
136
+        endin = in + insamples->audio->nb_samples * 2 - NUMTAPS;
137
+        scalarproduct(in, endin, out);
138
+
139
+        // save part of input for next round
140
+        memcpy(taps, endin, NUMTAPS * sizeof(*taps));
141
+    } else
142
+        memmove(taps, taps + 2*insamples->audio->nb_samples, NUMTAPS * sizeof(*taps));
139 143
 
140 144
     ret = ff_filter_frame(outlink, outsamples);
141 145
     avfilter_unref_buffer(insamples);