avfilter/avf_showcqt: fix unbounded index when copying to fft_data

When timeclamp and/or fps are low, j can be negative. Fix Ticket11640

Muhammad Faiz committed 1 year ago

Commit 35ea4581 parent aac1cdd1 file · +2 −2Browse files

Unified · Split

libavfilter/avf_showcqt.c+2−2

@@ -1516,7 +1516,7 @@ static int filter_frame(AVFilterLink inlink, AVFrame insamples) · 1515 unmodified lines
1516	i = insamples->nb_samples - remaining;	1516	i = insamples->nb_samples - remaining;
1517	j = s->fft_len/2 + s->remaining_fill_max - s->remaining_fill;	1517	j = s->fft_len/2 + s->remaining_fill_max - s->remaining_fill;
1518	if (remaining >= s->remaining_fill) {	1518	if (remaining >= s->remaining_fill) {
1519	for (m = 0; m < s->remaining_fill; m++) {	1519	for (m = FFMAX(0, -j); m < s->remaining_fill; m++) {
1520	s->fft_data[j+m].re = audio_data[2*(i+m)];	1520	s->fft_data[j+m].re = audio_data[2*(i+m)];
1521	s->fft_data[j+m].im = audio_data[2*(i+m)+1];	1521	s->fft_data[j+m].im = audio_data[2*(i+m)+1];
1522	}	1522	}
@@ -1545,7 +1545,7 @@ static int filter_frame(AVFilterLink inlink, AVFrame insamples) · 22 unmodified lines
1545	s->fft_data[m] = s->fft_data[m+step];	1545	s->fft_data[m] = s->fft_data[m+step];
1546	s->remaining_fill = step;	1546	s->remaining_fill = step;
1547	} else {	1547	} else {
1548	for (m = 0; m < remaining; m++) {	1548	for (m = FFMAX(0, -j); m < remaining; m++) {
1549	s->fft_data[j+m].re = audio_data[2*(i+m)];	1549	s->fft_data[j+m].re = audio_data[2*(i+m)];
1550	s->fft_data[j+m].im = audio_data[2*(i+m)+1];	1550	s->fft_data[j+m].im = audio_data[2*(i+m)+1];
1551	}	1551	}