diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-12-11 17:26:10 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-01-12 17:59:39 +0100 |
| commit | a4a63bf5b55f9b42b752301ae417ee3f50f5a594 (patch) | |
| tree | 5186d25f7dd51257cf221c6e3c9fe4241ef17a30 | |
| parent | bb35a42e93c1556511a1812dce7776afcea4001b (diff) | |
| download | ffmpeg-a4a63bf5b55f9b42b752301ae417ee3f50f5a594.tar.gz | |
aacdec: Fix an off-by-one overwrite when switching to LTP profile from MAIN.
Found-by: pawlkt
CC: libav-stable@libav.org
Fixes: CVE-2012-5144
(cherry picked from commit 6d5b0092678b2a95dfe209a207550bd2fe9ef646)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/aacdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 2b9b45c9e8..6478c7765b 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1747,7 +1747,7 @@ static void apply_tns(float coef[1024], TemporalNoiseShaping *tns, int w, filt, m, i; int bottom, top, order, start, end, size, inc; float lpc[TNS_MAX_ORDER]; - float tmp[TNS_MAX_ORDER]; + float tmp[TNS_MAX_ORDER + 1]; for (w = 0; w < ics->num_windows; w++) { bottom = ics->num_swb; |