diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-12-22 21:49:48 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-12-29 21:07:57 +0100 |
| commit | a88b06f9ee8c88f78bdd614fc25283225223e858 (patch) | |
| tree | 98d4a5fb10c825c3b4949ccead693a426690c529 /libavfilter | |
| parent | 61e73851a33f0b4cb7662f8578a4695e77bd3c19 (diff) | |
| download | ffmpeg-a88b06f9ee8c88f78bdd614fc25283225223e858.tar.gz | |
avfilter/af_alimiter: Check nextpos before use
Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg
Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavfilter')
| -rw-r--r-- | libavfilter/af_alimiter.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/libavfilter/af_alimiter.c b/libavfilter/af_alimiter.c index f08893229d..9a86704764 100644 --- a/libavfilter/af_alimiter.c +++ b/libavfilter/af_alimiter.c @@ -195,9 +195,10 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) int j = i % buffer_size; double ppeak = 0, pdelta; - for (c = 0; c < channels; c++) { - ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c])); - } + if (nextpos[j] >= 0) + for (c = 0; c < channels; c++) { + ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c])); + } pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels); if (pdelta < nextdelta[j]) { nextdelta[j] = pdelta; |