diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-15 23:43:03 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-17 21:37:31 +0100 |
| commit | ff663ae464c17150f9a2cdb7a0e549e266d5bac6 (patch) | |
| tree | 80d83c5b2c1d9077d0ee738ab0b0accd78deab25 /libavcodec/libspeexdec.c | |
| parent | d8c70ebd2c538d5349aadc0808950820d2dc447c (diff) | |
| download | ffmpeg-ff663ae464c17150f9a2cdb7a0e549e266d5bac6.tar.gz | |
sonic: make sure num_taps * channels is not larger than frame_size
If that is the case, the loop setting predictor_state in
sonic_decode_frame causes out of bounds reads of int_samples, which has
only frame_size number of elements.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9637c2531f7eb040ad1c3cb46cb40a63dfc77b80)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'libavcodec/libspeexdec.c')
0 files changed, 0 insertions, 0 deletions