diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-09 19:42:27 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-09 19:42:46 +0200 |
| commit | 2ec8e46550dc6a7df34d253484b43c47de833348 (patch) | |
| tree | bf7a452044cdbc474d5c880cc923cb7e86972f92 | |
| parent | b5ae0e349adc1c9581a6d88e9ba55cc5dd4493c2 (diff) | |
| parent | 50493f1f7d2235db811d2991b9e5b330baf7c05a (diff) | |
| download | ffmpeg-2ec8e46550dc6a7df34d253484b43c47de833348.tar.gz | |
Merge commit '50493f1f7d2235db811d2991b9e5b330baf7c05a' into release/0.10
* commit '50493f1f7d2235db811d2991b9e5b330baf7c05a':
twinvq: fix out of bounds array access
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/twinvq.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavcodec/twinvq.c b/libavcodec/twinvq.c index de53eb338d..e0b5747a30 100644 --- a/libavcodec/twinvq.c +++ b/libavcodec/twinvq.c @@ -1000,14 +1000,16 @@ static av_cold void construct_perm_table(TwinContext *tctx, int ftype) { int block_size; const ModeTab *mtab = tctx->mtab; - int size = tctx->avctx->channels*mtab->fmode[ftype].sub; + int size; int16_t *tmp_perm = (int16_t *) tctx->tmp_buf; if (ftype == FT_PPC) { size = tctx->avctx->channels; block_size = mtab->ppc_shape_len; - } else + } else { + size = tctx->avctx->channels * mtab->fmode[ftype].sub; block_size = mtab->size / mtab->fmode[ftype].sub; + } permutate_in_line(tmp_perm, tctx->n_div[ftype], size, block_size, tctx->length[ftype], |