This fixes a out of array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
index += dst_index * dst_incr;
index += (frac + dst_index * (int64_t)dst_incr_frac) / c->src_incr;
frac = (frac + dst_index * (int64_t)dst_incr_frac) % c->src_incr;
index += dst_index * dst_incr;
index += (frac + dst_index * (int64_t)dst_incr_frac) / c->src_incr;
frac = (frac + dst_index * (int64_t)dst_incr_frac) % c->src_incr;
+ av_assert2(index >= 0);
+ *consumed= index >> c->phase_shift;
+ index &= c->phase_mask;
}else if(compensation_distance == 0 && !c->linear && index >= 0){
}else if(compensation_distance == 0 && !c->linear && index >= 0){
for(dst_index=0; dst_index < dst_size; dst_index++){
for(dst_index=0; dst_index < dst_size; dst_index++){
- FELEM *filter= ((FELEM*)c->filter_bank) + c->filter_alloc*(index & c->phase_mask);
- int sample_index= index >> c->phase_shift;
+ FELEM *filter;
+ sample_index += index >> c->phase_shift;
+ index &= c->phase_mask;
+ filter= ((FELEM*)c->filter_bank) + c->filter_alloc*index;
if(sample_index + c->filter_length > src_size){
break;
if(sample_index + c->filter_length > src_size){
break;
+ *consumed = sample_index;
for(dst_index=0; dst_index < dst_size; dst_index++){
for(dst_index=0; dst_index < dst_size; dst_index++){
- FELEM *filter= ((FELEM*)c->filter_bank) + c->filter_alloc*(index & c->phase_mask);
- int sample_index= index >> c->phase_shift;
+ sample_index += index >> c->phase_shift;
+ index &= c->phase_mask;
+ filter = ((FELEM*)c->filter_bank) + c->filter_alloc*index;
+
if(sample_index + c->filter_length > src_size || -sample_index >= src_size){
break;
}else if(sample_index < 0){
if(sample_index + c->filter_length > src_size || -sample_index >= src_size){
break;
}else if(sample_index < 0){
dst_incr= c->ideal_dst_incr / c->src_incr;
}
}
dst_incr= c->ideal_dst_incr / c->src_incr;
}
}
+ *consumed= FFMAX(sample_index, 0);
+ index += FFMIN(sample_index, 0) << c->phase_shift;
- *consumed= FFMAX(index, 0) >> c->phase_shift;
- if(index>=0) index &= c->phase_mask;
if(compensation_distance){
compensation_distance -= dst_index;
if(compensation_distance){
compensation_distance -= dst_index;