From patchwork Thu Jan 6 00:26:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AlexisWilke X-Patchwork-Id: 33109 Delivered-To: ffmpegpatchwork2@gmail.com Received: by 2002:a6b:cd86:0:0:0:0:0 with SMTP id d128csp1212103iog; Wed, 5 Jan 2022 16:43:56 -0800 (PST) X-Google-Smtp-Source: ABdhPJxm/gDmzyqagL7D0HtJmbrqxRboSMqXaxqa4AwHl3ZgRT7O2KVo/YdMcLYuhST9kbK7CIw+ X-Received: by 2002:a17:907:ea2:: with SMTP id ho34mr44694144ejc.168.1641429836160; Wed, 05 Jan 2022 16:43:56 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1641429836; cv=none; d=google.com; s=arc-20160816; b=Dte80cmsFi0MuEApXaw8YnF49ALzkyZ4ZbawVBsEmLtBHlUK363gvHnD2EiLdXAKra fWRlIES4tLb7Q65qF80QRWrv/thFLmgzcAmNy1nVpZyRgsRWxPXbG0bmKJ7XGn3lYddf qt8xH0LoXLAfK6LVwgZmGR14yLp5/0txpyw0dPU3qW1gMBZfOIGQxNQODFnHEV5e/t0r HEh048EAOMwZlwHIvTG9r4YisHlJ+t1mTDx5N2tD3QpJMmswIsNzyfHj+jF15Kj2v5B4 Y+kS1hRyU6rvS/MDyTIEFsxVnaXJjQtHS4p5OagJJDrB5n3OGAieK3fRxZrlPudZtdNq 89Vg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:to:date:from:delivered-to; bh=FBAt31DOV2F84DIzMEYxK1Y83TSbsAoFEGzlnH2zmPQ=; b=s8+teQz16z0Zw2T2IOeVX91fwKsbu9kucvtVwxerU57DyMSa5GmBjvDrTjFpp3QZzs JJsX9uPb4RFnRYyji1rQgs4JP15tQJ6VFdpNeyHFmj/Du4uhVSB3QXEyTFxLwyVeFk7C h3r6rOKTSK9tUAzyj3hsE2c1w3SP91dQDWSdoz1QHP3J73PhVnkUeg7KTDW5+28at11X XzcAXhbqxUIEWavnMN+uq9GByIfiTLMxrNg26lfFoSc+gOqvXIC2xG8NTHnoJ2D3EBTT GsbAxQhPET78dBT2p3gkjYHrcOLTabffRvlIt8aPC5kbyyuCfD8dcjn/CTgFdKxPXx1M XwFA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=m2osw.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id ji15si254937ejc.287.2022.01.05.16.43.55; Wed, 05 Jan 2022 16:43:56 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=m2osw.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 7D66F68ACAE; Thu, 6 Jan 2022 02:43:51 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from m2osw.com (m2osw.com [138.197.205.139]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 4A64B68A75B for ; Thu, 6 Jan 2022 02:43:44 +0200 (EET) Received: by m2osw.com (Postfix, from userid 1000) id C06AC3F170; Thu, 6 Jan 2022 00:43:41 +0000 (UTC) From: AlexisWilke Date: Wed, 5 Jan 2022 16:26:09 -0800 X-Unsent: 1 To: ffmpeg-devel@ffmpeg.org Message-Id: <20220106004341.C06AC3F170@m2osw.com> Subject: [FFmpeg-devel] [PATCH] Fix for possible buffer overflow. X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" X-TUID: MkfRsugXxWiL If it is true that the (index + c) can be larger than s->limiter_buf_size then the overflow potential has to be handled in the previous two statements. Signed-off-by: AlexisWilke --- libavfilter/af_loudnorm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavfilter/af_loudnorm.c b/libavfilter/af_loudnorm.c index dbe7fba986..9e6a830a56 100644 --- a/libavfilter/af_loudnorm.c +++ b/libavfilter/af_loudnorm.c @@ -206,10 +206,11 @@ static void detect_peak(LoudNormContext *s, int offset, int nb_samples, int chan continue; for (c = 0; c < channels; c++) { - if (c == 0 || fabs(buf[index + c]) > max_peak) - max_peak = fabs(buf[index + c]); + int idx((index + c) < s->limiter_buf_size ? (index + c) : (index + c - s->limiter_buf_size)); + if (c == 0 || fabs(buf[idx]) > max_peak) + max_peak = fabs(buf[idx]); - s->prev_smp[c] = fabs(buf[(index + c) < s->limiter_buf_size ? (index + c) : (index + c - s->limiter_buf_size)]); + s->prev_smp[c] = fabs(buf[idx]); } *peak_delta = n;