generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

twinvq: fix out of bounds array access

Browse Source 
ModeTab.fmode has only 3 elements, so indexing it with ftype
in the initialier for 'size' is invalid when ftype == FT_PPC.

This fixes crashes with gcc 4.8.

Signed-off-by: Mans Rullgard <mans@mansr.com>
(cherry picked from commit 4bf2e7c5f1c0ad3997fd7c9859c16db8e4e16df6)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
This commit is contained in:
Mans Rullgard 2012-05-01 18:27:19 +01:00 committed by Diego Biurrun
parent 3e60501f31
commit 50493f1f7d
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/twinvq.c
View File

@ -1000,14 +1000,16 @@ static av_cold void construct_perm_table(TwinContext *tctx, int ftype)
{ {
int block_size; int block_size;
const ModeTab *mtab = tctx->mtab; const ModeTab *mtab = tctx->mtab;
int size = tctx->avctx->channels*mtab->fmode[ftype].sub; int size;
int16_t *tmp_perm = (int16_t *) tctx->tmp_buf; int16_t *tmp_perm = (int16_t *) tctx->tmp_buf;
if (ftype == FT_PPC) { if (ftype == FT_PPC) {
size = tctx->avctx->channels; size = tctx->avctx->channels;
block_size = mtab->ppc_shape_len; block_size = mtab->ppc_shape_len;
} else } else {
size = tctx->avctx->channels * mtab->fmode[ftype].sub;
block_size = mtab->size / mtab->fmode[ftype].sub; block_size = mtab->size / mtab->fmode[ftype].sub;
}
permutate_in_line(tmp_perm, tctx->n_div[ftype], size, permutate_in_line(tmp_perm, tctx->n_div[ftype], size,
block_size, tctx->length[ftype], block_size, tctx->length[ftype],