diff options
| author | Jean-Marc Valin <jmvalin@jmvalin.ca> | 2016-07-24 15:37:27 -0400 |
|---|---|---|
| committer | Jean-Marc Valin <jmvalin@jmvalin.ca> | 2016-07-24 21:35:15 -0400 |
| commit | e32cd2729ea5db22071768c2468cb78454541138 (patch) | |
| tree | bd8d3ff8ad84e5c514d83bc81064e9b0c544a4f6 | |
| parent | cbceaa8579e16c0690e6f6469c459d889b0a3e36 (diff) | |
| download | opus-e32cd2729ea5db22071768c2468cb78454541138.tar.gz | |
Avoids reading beyond the current buffer in comb_filter()
This could cause overflows when processing non-saturated TDAC values.
| -rw-r--r-- | celt/celt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/celt/celt.c b/celt/celt.c index f332191c..9ce23469 100644 --- a/celt/celt.c +++ b/celt/celt.c @@ -207,6 +207,10 @@ void comb_filter(opus_val32 *y, opus_val32 *x, int T0, int T1, int N, OPUS_MOVE(y, x, N); return; } + /* When the gain is zero, T0 and/or T1 is set to zero. We need + to have then be at least 2 to avoid processing garbage data. */ + T0 = IMAX(T0, COMBFILTER_MINPERIOD); + T1 = IMAX(T1, COMBFILTER_MINPERIOD); g00 = MULT16_16_P15(g0, gains[tapset0][0]); g01 = MULT16_16_P15(g0, gains[tapset0][1]); g02 = MULT16_16_P15(g0, gains[tapset0][2]); |