avfilter/af_earwax: Fix out of array accesses on odd packets

Found-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 12 insertions, 7 deletions

diff --git a/libavfilter/af_earwax.c b/libavfilter/af_earwax.c
index 189243a672..3db4659c35 100644
--- a/libavfilter/af_earwax.c
+++ b/libavfilter/af_earwax.c
@@ -114,6 +114,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples)
     AVFilterLink *outlink = inlink->dst->outputs[0];
     int16_t *taps, *endin, *in, *out;
     AVFrame *outsamples = ff_get_audio_buffer(inlink, insamples->nb_samples);
+    int len;
 
     if (!outsamples) {
         av_frame_free(&insamples);
@@ -125,16 +126,20 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples)
     out   = (int16_t *)outsamples->data[0];
     in    = (int16_t *)insamples ->data[0];
 
+    len = FFMIN(NUMTAPS, 2*insamples->nb_samples);
     // copy part of new input and process with saved input
-    memcpy(taps+NUMTAPS, in, NUMTAPS * sizeof(*taps));
-    out   = scalarproduct(taps, taps + NUMTAPS, out);
+    memcpy(taps+NUMTAPS, in, len * sizeof(*taps));
+    out   = scalarproduct(taps, taps + len, out);
 
     // process current input
-    endin = in + insamples->nb_samples * 2 - NUMTAPS;
-    scalarproduct(in, endin, out);
-
-    // save part of input for next round
-    memcpy(taps, endin, NUMTAPS * sizeof(*taps));
+    if (2*insamples->nb_samples >= NUMTAPS ){
+        endin = in + insamples->nb_samples * 2 - NUMTAPS;
+        scalarproduct(in, endin, out);
+
+        // save part of input for next round
+        memcpy(taps, endin, NUMTAPS * sizeof(*taps));
+    } else
+        memmove(taps, taps + 2*insamples->nb_samples, NUMTAPS * sizeof(*taps));
 
     av_frame_free(&insamples);
     return ff_filter_frame(outlink, outsamples);