diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 03:59:29 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-03 18:17:42 +0100 |
| commit | 6b7a14e5993848ffa6a388ca3829b3b2652f7afc (patch) | |
| tree | eb6242f1fff6244bbb6907ad8c13c1acb7ccc097 | |
| parent | b6c19c9c918aee09d28606df4fe0481f96bc3695 (diff) | |
| download | ffmpeg-6b7a14e5993848ffa6a388ca3829b3b2652f7afc.tar.gz | |
aacsbr: Fix memory corruption.
Fixes Ticket760 and Ticket761
Bug Found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 944f5b2779e4aa63f7624df6cd4de832a53db81b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/aacsbr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c index a213827132..d2f37c5e10 100644 --- a/libavcodec/aacsbr.c +++ b/libavcodec/aacsbr.c @@ -1187,7 +1187,7 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct, const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us; float *v; for (i = 0; i < 32; i++) { - if (*v_off == 0) { + if (*v_off < 128 >> div) { int saved_samples = (1280 - 128) >> div; memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float)); *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div); |