Some code in alimiter assumes that there are 2 channels, resulting in
clipping if the loudest channel is 3 or above and an out-of-bounds read if
the input is monophonic.  Fix that in 2 places.

Signed-off-by: David Flater <d...@flaterco.com>
---
 libavfilter/af_alimiter.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/libavfilter/af_alimiter.c b/libavfilter/af_alimiter.c
index 622dc66324..c683c4bcf4 100644
--- a/libavfilter/af_alimiter.c
+++ b/libavfilter/af_alimiter.c
@@ -194,10 +194,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
             } else {
                 for (i = s->nextiter; i < s->nextiter + s->nextlen; i++) {
                     int j = i % buffer_size;
-                    double ppeak, pdelta;
+                    double ppeak = 0, pdelta;
 
-                    ppeak = fabs(buffer[nextpos[j]]) > fabs(buffer[nextpos[j] 
+ 1]) ?
-                            fabs(buffer[nextpos[j]]) : fabs(buffer[nextpos[j] 
+ 1]);
+                    for (c = 0; c < channels; c++) {
+                        ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c]));
+                    }
                     pdelta = (limit / peak - limit / ppeak) / (((buffer_size - 
nextpos[j] + s->pos) % buffer_size) / channels);
                     if (pdelta < nextdelta[j]) {
                         nextdelta[j] = pdelta;
@@ -241,14 +242,16 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
                 s->delta = get_rdelta(s, release, inlink->sample_rate,
                                       peak, limit, s->att, 1);
                 if (s->nextlen > 1) {
+                    double ppeak = 0, pdelta;
                     int pnextpos = nextpos[(s->nextiter + 1) % buffer_size];
-                    double ppeak = fabs(buffer[pnextpos]) > 
fabs(buffer[pnextpos + 1]) ?
-                                                            
fabs(buffer[pnextpos]) :
-                                                            
fabs(buffer[pnextpos + 1]);
-                    double pdelta = (limit / ppeak - s->att) /
-                                    (((buffer_size + pnextpos -
-                                    ((s->pos + channels) % buffer_size)) %
-                                    buffer_size) / channels);
+
+                    for (c = 0; c < channels; c++) {
+                        ppeak = FFMAX(ppeak, fabs(buffer[pnextpos + c]));
+                    }
+                    pdelta = (limit / ppeak - s->att) /
+                             (((buffer_size + pnextpos -
+                             ((s->pos + channels) % buffer_size)) %
+                             buffer_size) / channels);
                     if (pdelta < s->delta)
                         s->delta = pdelta;
                 }
-- 
2.35.3

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".

Reply via email to