mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2026-02-12 04:59:59 +00:00
be82aef7cc
fix a simple index bug in ff_aac_usac_reset_state() that writes past the end of ChannelElement.ch[2] for CPE ff_aac_usac_reset_state() loops over channels with j < ch, but incorrectly takes &che->ch[ch]. For CPE (ch == 2) this becomes che->ch[2], which is one past the end of ChannelElement.ch[2], and the subsequent memset() causes an intra-object out-of-bounds write. index the channel element with the loop variable (j). |
||
|---|---|---|
| .. | ||
| aacdec.c | ||
| aacdec.h | ||
| aacdec_ac.c | ||
| aacdec_ac.h | ||
| aacdec_dsp_template.c | ||
| aacdec_fixed.c | ||
| aacdec_fixed_coupling.h | ||
| aacdec_fixed_dequant.h | ||
| aacdec_fixed_prediction.h | ||
| aacdec_float.c | ||
| aacdec_float_coupling.h | ||
| aacdec_float_prediction.h | ||
| aacdec_latm.h | ||
| aacdec_lpd.c | ||
| aacdec_lpd.h | ||
| aacdec_proc_template.c | ||
| aacdec_tab.c | ||
| aacdec_tab.h | ||
| aacdec_usac.c | ||
| aacdec_usac.h | ||
| Makefile | ||