diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 03:59:29 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-12 21:52:43 +0100 |
| commit | 6f0e349a023c9690ef21a94ac5eb8451cf1cce95 (patch) | |
| tree | fd1d47c0ae1be6a3240e39255477015d0d2d25a5 | |
| parent | 56173eabb6fb508574150098ac835b3b3e6a8569 (diff) | |
| download | ffmpeg-6f0e349a023c9690ef21a94ac5eb8451cf1cce95.tar.gz | |
aacsbr: Fix memory corruption.
Fixes Ticket760 and Ticket761
Bug Found by: Diana Elena Muscalu
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 944f5b2779e4aa63f7624df6cd4de832a53db81b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/aacsbr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/aacsbr.c b/libavcodec/aacsbr.c index 10b8daf280..866482aac3 100644 --- a/libavcodec/aacsbr.c +++ b/libavcodec/aacsbr.c @@ -1185,7 +1185,7 @@ static void sbr_qmf_synthesis(DSPContext *dsp, FFTContext *mdct, const float *sbr_qmf_window = div ? sbr_qmf_window_ds : sbr_qmf_window_us; float *v; for (i = 0; i < 32; i++) { - if (*v_off == 0) { + if (*v_off < 128 >> div) { int saved_samples = (1280 - 128) >> div; memcpy(&v0[SBR_SYNTHESIS_BUF_SIZE - saved_samples], v0, saved_samples * sizeof(float)); *v_off = SBR_SYNTHESIS_BUF_SIZE - saved_samples - (128 >> div); |