Module: libav Branch: release/0.8 Commit: a4a63bf5b55f9b42b752301ae417ee3f50f5a594
Author: Alex Converse <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Tue Dec 11 17:26:10 2012 -0800 aacdec: Fix an off-by-one overwrite when switching to LTP profile from MAIN. Found-by: pawlkt CC: [email protected] Fixes: CVE-2012-5144 (cherry picked from commit 6d5b0092678b2a95dfe209a207550bd2fe9ef646) Signed-off-by: Reinhard Tartler <[email protected]> --- libavcodec/aacdec.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index 2b9b45c..6478c77 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1747,7 +1747,7 @@ static void apply_tns(float coef[1024], TemporalNoiseShaping *tns, int w, filt, m, i; int bottom, top, order, start, end, size, inc; float lpc[TNS_MAX_ORDER]; - float tmp[TNS_MAX_ORDER]; + float tmp[TNS_MAX_ORDER + 1]; for (w = 0; w < ics->num_windows; w++) { bottom = ics->num_swb; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
