FaSTTUBe/GST-Tensordecoder-ov_ep
37
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

dvdlpcmdec: fix invalid read beyond channel position array

Browse Source 
We would always copy sizeof(sorted_position) bytes, which is
for 8 channels, but if we have less than 8 channels the
position array we copy from will only have allocated space
for channel channels, so we would read beyond the input
array in some cases.
This commit is contained in:
Tim-Philipp Müller 2015-09-26 09:23:05 +01:00
parent d7f78391b4
commit d57b097198
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gst/dvdlpcmdec/gstdvdlpcmdec.c
View File

@ -250,10 +250,12 @@ gst_dvdlpcmdec_update_audio_formats (GstDvdLpcmDec * dec, gint channels,
GST_AUDIO_CHANNEL_POSITION_INVALID) {
const GstAudioChannelPosition *position;
GstAudioChannelPosition sorted_position[8];
guint c;
position = channel_positions[channels - 1];
dec->lpcm_layout = position;
memcpy (sorted_position, position, sizeof (sorted_position));
for (c = 0; c < channels; ++c)
sorted_position[c] = position[c];
gst_audio_channel_positions_to_valid_order (sorted_position, channels);
gst_audio_info_set_format (&dec->info, format, rate, channels,
sorted_position);