diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-12-11 17:26:10 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-01-12 19:27:42 +0100 |
| commit | b143844ea0f6246e0d5a938d743e2e8a98453bec (patch) | |
| tree | 18c338474022f901decf7c9f16dfd4a71e2ffd8f | |
| parent | 4ede95e69cf964cd46b1e9fcd48da80d8d92c433 (diff) | |
| download | ffmpeg-b143844ea0f6246e0d5a938d743e2e8a98453bec.tar.gz | |
aacdec: Fix an off-by-one overwrite when switching to LTP profile from MAIN.
Found-by: pawlkt
CC: libav-stable@libav.org
Fixes: CVE-2012-5144
(cherry picked from commit 6d5b0092678b2a95dfe209a207550bd2fe9ef646)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/aacdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index cf7b43d53f..d479c947a9 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1692,7 +1692,7 @@ static void apply_tns(float coef[1024], TemporalNoiseShaping *tns, int w, filt, m, i; int bottom, top, order, start, end, size, inc; float lpc[TNS_MAX_ORDER]; - float tmp[TNS_MAX_ORDER]; + float tmp[TNS_MAX_ORDER + 1]; for (w = 0; w < ics->num_windows; w++) { bottom = ics->num_swb; |