Fixes: Ticket5297
Needs review by maintainer / author to check that this is ok and sufficient
---
libavcodec/alsdec.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c
index a7e58a2..9410f52 100644
--- a/libavcodec/alsdec.c
+++ b/libavcodec/alsdec.c
@@ -694,7 +694,7 @@ static int read_var_block_data(ALSDecContext *ctx,
ALSBlockData *bd)
} else {
*bd->opt_order = sconf->max_order;
}
- if (*bd->opt_order > bd->block_length) {
+ if (*bd->opt_order > bd->block_length + sconf->max_order) {
*bd->opt_order = bd->block_length;
av_log(avctx, AV_LOG_ERROR, "Predictor order too large.\n");
return AVERROR_INVALIDDATA;
@@ -1252,7 +1252,7 @@ static int revert_channel_correlation(ALSDecContext *ctx,
ALSBlockData *bd,
ALSChannelData *ch = cd[c];
unsigned int dep = 0;
unsigned int channels = ctx->avctx->channels;
- unsigned int channel_size = ctx->sconf.frame_length + ctx->sconf.max_order;
+ unsigned int channel_size = ctx->sconf.frame_length +
2*ctx->sconf.max_order;
if (reverted[c])
return 0;
@@ -1311,7 +1311,7 @@ static int revert_channel_correlation(ALSDecContext *ctx,
ALSBlockData *bd,
}
if (FFMIN(begin - 1, begin - 1 + t) < ctx->raw_buffer - master ||
- FFMAX(end + 1, end + 1 + t) > ctx->raw_buffer + channels *
channel_size - master) {
+ FFMAX(end + 1, end + 1 + t) > ctx->raw_buffer + channels *
channel_size - master - ctx->sconf.max_order) {
av_log(ctx->avctx, AV_LOG_ERROR,
"sample pointer range [%p, %p] not contained in
raw_buffer [%p, %p].\n",
master + FFMIN(begin - 1, begin - 1 + t), master +
FFMAX(end + 1, end + 1 + t),
@@ -1333,7 +1333,7 @@ static int revert_channel_correlation(ALSDecContext *ctx,
ALSBlockData *bd,
} else {
if (begin - 1 < ctx->raw_buffer - master ||
- end + 1 > ctx->raw_buffer + channels * channel_size -
master) {
+ end + 1 > ctx->raw_buffer + channels * channel_size - master
- ctx->sconf.max_order) {
av_log(ctx->avctx, AV_LOG_ERROR,
"sample pointer range [%p, %p] not contained in
raw_buffer [%p, %p].\n",
master + begin - 1, master + end + 1,
@@ -1797,7 +1797,7 @@ static av_cold int decode_init(AVCodecContext *avctx)
ctx->reverted_channels = NULL;
}
- channel_size = sconf->frame_length + sconf->max_order;
+ channel_size = sconf->frame_length + 2*sconf->max_order;
ctx->prev_raw_samples = av_malloc_array(sconf->max_order,
sizeof(*ctx->prev_raw_samples));
ctx->raw_buffer = av_mallocz_array(avctx->channels * channel_size,
sizeof(*ctx->raw_buffer));
--
1.7.9.5
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
