From 0a3a0edd52b98aec27d1b8c63c85cb52ff46d40e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 10 Jul 2013 16:39:10 +0200 Subject: [PATCH] avfilter/af_earwax: Fix out of array accesses on odd packets Found-by: Paul B Mahol Signed-off-by: Michael Niedermayer --- libavfilter/af_earwax.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/libavfilter/af_earwax.c b/libavfilter/af_earwax.c index 189243a672..3db4659c35 100644 --- a/libavfilter/af_earwax.c +++ b/libavfilter/af_earwax.c @@ -114,6 +114,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples) AVFilterLink *outlink = inlink->dst->outputs[0]; int16_t *taps, *endin, *in, *out; AVFrame *outsamples = ff_get_audio_buffer(inlink, insamples->nb_samples); + int len; if (!outsamples) { av_frame_free(&insamples); @@ -125,16 +126,20 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *insamples) out = (int16_t *)outsamples->data[0]; in = (int16_t *)insamples ->data[0]; + len = FFMIN(NUMTAPS, 2*insamples->nb_samples); // copy part of new input and process with saved input - memcpy(taps+NUMTAPS, in, NUMTAPS * sizeof(*taps)); - out = scalarproduct(taps, taps + NUMTAPS, out); + memcpy(taps+NUMTAPS, in, len * sizeof(*taps)); + out = scalarproduct(taps, taps + len, out); // process current input - endin = in + insamples->nb_samples * 2 - NUMTAPS; - scalarproduct(in, endin, out); + if (2*insamples->nb_samples >= NUMTAPS ){ + endin = in + insamples->nb_samples * 2 - NUMTAPS; + scalarproduct(in, endin, out); - // save part of input for next round - memcpy(taps, endin, NUMTAPS * sizeof(*taps)); + // save part of input for next round + memcpy(taps, endin, NUMTAPS * sizeof(*taps)); + } else + memmove(taps, taps + 2*insamples->nb_samples, NUMTAPS * sizeof(*taps)); av_frame_free(&insamples); return ff_filter_frame(outlink, outsamples);