From 6535d81d8788a6eb758dd08330d4915c224fa5ee Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 16 Nov 2012 21:25:40 +0100 Subject: [PATCH] g723_1dec: Fix lsp2lpc() so it can handle values at the ends of the table. Fixes out of array reads Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/g723_1.c | 2 +- libavcodec/g723_1_data.h | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/libavcodec/g723_1.c b/libavcodec/g723_1.c index 58df03c0ef..fd6b558ef3 100644 --- a/libavcodec/g723_1.c +++ b/libavcodec/g723_1.c @@ -359,7 +359,7 @@ static void lsp2lpc(int16_t *lpc) /* Calculate negative cosine */ for (j = 0; j < LPC_ORDER; j++) { - int index = lpc[j] >> 7; + int index = (lpc[j] >> 7) & 0x1FF; int offset = lpc[j] & 0x7f; int temp1 = cos_tab[index] << 16; int temp2 = (cos_tab[index + 1] - cos_tab[index]) * diff --git a/libavcodec/g723_1_data.h b/libavcodec/g723_1_data.h index 8ee4a91841..38a6c59985 100644 --- a/libavcodec/g723_1_data.h +++ b/libavcodec/g723_1_data.h @@ -128,7 +128,7 @@ static const int16_t dc_lsp[LPC_ORDER] = { /** * Cosine table scaled by 2^14 */ -static const int16_t cos_tab[COS_TBL_SIZE] = { +static const int16_t cos_tab[COS_TBL_SIZE+1] = { 16384, 16383, 16379, 16373, 16364, 16353, 16340, 16324, 16305, 16284, 16261, 16235, 16207, 16176, 16143, 16107, 16069, 16029, 15986, 15941, 15893, 15843, 15791, 15736, @@ -193,6 +193,7 @@ static const int16_t cos_tab[COS_TBL_SIZE] = { 15679, 15736, 15791, 15843, 15893, 15941, 15986, 16029, 16069, 16107, 16143, 16176, 16207, 16235, 16261, 16284, 16305, 16324, 16340, 16353, 16364, 16373, 16379, 16383, + 16384 }; /**