Some code in alimiter assumes that there are 2 channels, resulting in clipping if the loudest channel is 3 or above and an out-of-bounds read if the input is monophonic. Fix that in 2 places.
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -194,10 +194,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) · 193 unmodified lines | ||
| 194 | 194 | } else { |
| 195 | 195 | for (i = s->nextiter; i < s->nextiter + s->nextlen; i++) { |
| 196 | 196 | int j = i % buffer_size; |
| 197 | − double ppeak, pdelta; | |
| 197 | + double ppeak = 0, pdelta; | |
| 198 | 198 | |
| 199 | − ppeak = fabs(buffer[nextpos[j]]) > fabs(buffer[nextpos[j] + 1]) ? | |
| 200 | − fabs(buffer[nextpos[j]]) : fabs(buffer[nextpos[j] + 1]); | |
| 199 | + for (c = 0; c < channels; c++) { | |
| 200 | + ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c])); | |
| 201 | + } | |
| 201 | 202 | pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels); |
| 202 | 203 | if (pdelta < nextdelta[j]) { |
| 203 | 204 | nextdelta[j] = pdelta; |
| @@ -241,14 +242,16 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) · 37 unmodified lines | ||
| 241 | 242 | s->delta = get_rdelta(s, release, inlink->sample_rate, |
| 242 | 243 | peak, limit, s->att, 1); |
| 243 | 244 | if (s->nextlen > 1) { |
| 245 | + double ppeak = 0, pdelta; | |
| 244 | 246 | int pnextpos = nextpos[(s->nextiter + 1) % buffer_size]; |
| 245 | − double ppeak = fabs(buffer[pnextpos]) > fabs(buffer[pnextpos + 1]) ? | |
| 246 | − fabs(buffer[pnextpos]) : | |
| 247 | − fabs(buffer[pnextpos + 1]); | |
| 248 | − double pdelta = (limit / ppeak - s->att) / | |
| 249 | − (((buffer_size + pnextpos - | |
| 250 | − ((s->pos + channels) % buffer_size)) % | |
| 251 | − buffer_size) / channels); | |
| 247 | + | |
| 248 | + for (c = 0; c < channels; c++) { | |
| 249 | + ppeak = FFMAX(ppeak, fabs(buffer[pnextpos + c])); | |
| 250 | + } | |
| 251 | + pdelta = (limit / ppeak - s->att) / | |
| 252 | + (((buffer_size + pnextpos - | |
| 253 | + ((s->pos + channels) % buffer_size)) % | |
| 254 | + buffer_size) / channels); | |
| 252 | 255 | if (pdelta < s->delta) |
| 253 | 256 | s->delta = pdelta; |
| 254 | 257 | } |