From 3d79d0c93e5b37a35b1b22d6c18699c233aad1ba Mon Sep 17 00:00:00 2001 From: Martin Storsjö Date: Thu, 5 Jun 2014 11:48:53 +0300 Subject: adpcm: Avoid reading out of bounds in the IMA QT trellis encoder MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This was broken in 095be4fb - samples+ch (for the previous non-planar case) equals &samples_p[ch][0]. The confusion probably stemmed from the IMA WAV case where it originally was &samples[avctx->channels + ch], which was correctly changed into &samples_p[ch][1]. CC: libav-stable@libav.org Signed-off-by: Martin Storsjö --- libavcodec/adpcmenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'libavcodec/adpcmenc.c') diff --git a/libavcodec/adpcmenc.c b/libavcodec/adpcmenc.c index fb3ce0d24b..2cf8d6f8a2 100644 --- a/libavcodec/adpcmenc.c +++ b/libavcodec/adpcmenc.c @@ -549,7 +549,7 @@ static int adpcm_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, put_bits(&pb, 7, status->step_index); if (avctx->trellis > 0) { uint8_t buf[64]; - adpcm_compress_trellis(avctx, &samples_p[ch][1], buf, status, + adpcm_compress_trellis(avctx, &samples_p[ch][0], buf, status, 64, 1); for (i = 0; i < 64; i++) put_bits(&pb, 4, buf[i ^ 1]); -- cgit v1.2.3