diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-12-12 01:21:24 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-12-12 01:22:09 +0100 |
| commit | 2fb240ddb6963257c57394dd0d35d1a41ba517d7 (patch) | |
| tree | 4fdf040916b3a3bfcb1b8820ef4641b47f25c00a /libavcodec | |
| parent | a202541f9b4da3e489716198dd3547ec7f73ef1d (diff) | |
| download | ffmpeg-2fb240ddb6963257c57394dd0d35d1a41ba517d7.tar.gz | |
ac3dec: fix out of array read
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/ac3dec.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/libavcodec/ac3dec.c b/libavcodec/ac3dec.c index 1013901a40..0bc1adafdd 100644 --- a/libavcodec/ac3dec.c +++ b/libavcodec/ac3dec.c @@ -1386,12 +1386,11 @@ static int ac3_decode_frame(AVCodecContext * avctx, void *data, channel_map = ff_ac3_dec_channel_map[s->output_mode & ~AC3_OUTPUT_LFEON][s->lfe_on]; for (ch = 0; ch < AC3_MAX_CHANNELS; ch++) { output[ch] = s->output[ch]; + s->outptr[ch] = s->output[ch]; } for (ch = 0; ch < s->channels; ch++) { if (ch < s->out_channels) s->outptr[channel_map[ch]] = (float *)s->frame.data[ch]; - else - s->outptr[ch] = s->output[ch]; } for (blk = 0; blk < s->num_blocks; blk++) { if (!err && decode_audio_block(s, blk)) { |