aacenc: update max_sfb when num_swb changes
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Sun, 6 Dec 2015 20:35:08 +0000 (21:35 +0100)
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Tue, 8 Dec 2015 21:53:09 +0000 (22:53 +0100)
This fixes out-of-bounds reads in avoid_clipping.

Reviewed-by: Rostislav Pehlivanov <atomnuker@gmail.com>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavcodec/aacenc.c

index 200f8c4..3406f43 100644 (file)
@@ -574,6 +574,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             ics->num_windows        = wi[ch].num_windows;
             ics->swb_sizes          = s->psy.bands    [ics->num_windows == 8];
             ics->num_swb            = tag == TYPE_LFE ? ics->num_swb : s->psy.num_bands[ics->num_windows == 8];
+            ics->max_sfb            = FFMIN(ics->max_sfb, ics->num_swb);
             ics->swb_offset         = wi[ch].window_type[0] == EIGHT_SHORT_SEQUENCE ?
                                         ff_swb_offset_128 [s->samplerate_index]:
                                         ff_swb_offset_1024[s->samplerate_index];