virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-29 22:00:58 +02:00
Code Issues Releases Activity

avfilter/af_alimiter: Check nextpos before use

Browse Source 
Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit a88b06f9ee8c88f78bdd614fc25283225223e858)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2023-12-22 21:49:48 +01:00
parent 76a48e85e4
commit ea0181c5f8
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavfilter/af_alimiter.c
View File

@ -176,10 +176,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
} else { } else {
for (i = s->nextiter; i < s->nextiter + s->nextlen; i++) { for (i = s->nextiter; i < s->nextiter + s->nextlen; i++) {
int j = i % buffer_size; int j = i % buffer_size;
double ppeak, pdelta; double ppeak = 0, pdelta;
ppeak = fabs(buffer[nextpos[j]]) > fabs(buffer[nextpos[j] + 1]) ? if (nextpos[j] >= 0)
fabs(buffer[nextpos[j]]) : fabs(buffer[nextpos[j] + 1]); ppeak = fabs(buffer[nextpos[j]]) > fabs(buffer[nextpos[j] + 1]) ?
fabs(buffer[nextpos[j]]) : fabs(buffer[nextpos[j] + 1]);
pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels); pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels);
if (pdelta < nextdelta[j]) { if (pdelta < nextdelta[j]) {
nextdelta[j] = pdelta; nextdelta[j] = pdelta;