Some code in alimiter assumes that there are 2 channels, resulting in clipping if the loudest channel is 3 or above and an out-of-bounds read if the input is monophonic. Fix that in 2 places.
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -194,10 +194,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) · 193 unmodified lines | |||
| 194 | } else { | 194 | } else { |
| 195 | for (i = s->nextiter; i < s->nextiter + s->nextlen; i++) { | 195 | for (i = s->nextiter; i < s->nextiter + s->nextlen; i++) { |
| 196 | int j = i % buffer_size; | 196 | int j = i % buffer_size; |
| 197 | double ppeak, pdelta; | 197 | double ppeak = 0, pdelta; |
| 198 | 198 | ||
| 199 | ppeak = fabs(buffer[nextpos[j]]) > fabs(buffer[nextpos[j] + 1]) ? | 199 | for (c = 0; c < channels; c++) { |
| 200 | fabs(buffer[nextpos[j]]) : fabs(buffer[nextpos[j] + 1]); | 200 | ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c])); |
| 201 | } | ||
| 201 | pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels); | 202 | pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels); |
| 202 | if (pdelta < nextdelta[j]) { | 203 | if (pdelta < nextdelta[j]) { |
| 203 | nextdelta[j] = pdelta; | 204 | nextdelta[j] = pdelta; |
| @@ -241,14 +242,16 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) · 37 unmodified lines | |||
| 241 | s->delta = get_rdelta(s, release, inlink->sample_rate, | 242 | s->delta = get_rdelta(s, release, inlink->sample_rate, |
| 242 | peak, limit, s->att, 1); | 243 | peak, limit, s->att, 1); |
| 243 | if (s->nextlen > 1) { | 244 | if (s->nextlen > 1) { |
| 245 | double ppeak = 0, pdelta; | ||
| 244 | int pnextpos = nextpos[(s->nextiter + 1) % buffer_size]; | 246 | int pnextpos = nextpos[(s->nextiter + 1) % buffer_size]; |
| 245 | double ppeak = fabs(buffer[pnextpos]) > fabs(buffer[pnextpos + 1]) ? | 247 | |
| 246 | fabs(buffer[pnextpos]) : | 248 | for (c = 0; c < channels; c++) { |
| 247 | fabs(buffer[pnextpos + 1]); | 249 | ppeak = FFMAX(ppeak, fabs(buffer[pnextpos + c])); |
| 248 | double pdelta = (limit / ppeak - s->att) / | 250 | } |
| 249 | (((buffer_size + pnextpos - | 251 | pdelta = (limit / ppeak - s->att) / |
| 250 | ((s->pos + channels) % buffer_size)) % | 252 | (((buffer_size + pnextpos - |
| 251 | buffer_size) / channels); | 253 | ((s->pos + channels) % buffer_size)) % |
| 254 | buffer_size) / channels); | ||
| 252 | if (pdelta < s->delta) | 255 | if (pdelta < s->delta) |
| 253 | s->delta = pdelta; | 256 | s->delta = pdelta; |
| 254 | } | 257 | } |