comparison celp_filters.c @ 9446:1a3865d1b049 libavcodec

Fix possibly harmful outbound addressing. Patch by Kenan Gillet.
author reynaldo
date Wed, 15 Apr 2009 19:28:28 +0000
parents 1e2c96617886
children d7554a5e3fd7
comparison
equal deleted inserted replaced
9445:41245484dc0b 9446:1a3865d1b049
59 int stop_on_overflow, 59 int stop_on_overflow,
60 int rounder) 60 int rounder)
61 { 61 {
62 int i,n; 62 int i,n;
63 63
64 // These two lines are to avoid a -1 subtraction in the main loop 64 // This line is to avoid a +1 subtraction in the main loop.
65 filter_length++; 65 filter_length++;
66 filter_coeffs--;
67 66
68 for(n=0; n<buffer_length; n++) 67 for(n=0; n<buffer_length; n++)
69 { 68 {
70 int sum = rounder; 69 int sum = rounder;
71 for(i=1; i<filter_length; i++) 70 for(i=1; i<filter_length; i++)
72 sum -= filter_coeffs[i] * out[n-i]; 71 sum -= filter_coeffs[i-1] * out[n-i];
73 72
74 sum = (sum >> 12) + in[n]; 73 sum = (sum >> 12) + in[n];
75 74
76 if(sum + 0x8000 > 0xFFFFU) 75 if(sum + 0x8000 > 0xFFFFU)
77 { 76 {
92 int buffer_length, 91 int buffer_length,
93 int filter_length) 92 int filter_length)
94 { 93 {
95 int i,n; 94 int i,n;
96 95
97 // These two lines are to avoid a -1 subtraction in the main loop 96 // This line is to avoid a +1 subtraction in the main loop
98 filter_length++; 97 filter_length++;
99 filter_coeffs--;
100 98
101 for(n=0; n<buffer_length; n++) 99 for(n=0; n<buffer_length; n++)
102 { 100 {
103 out[n] = in[n]; 101 out[n] = in[n];
104 for(i=1; i<filter_length; i++) 102 for(i=1; i<filter_length; i++)
105 out[n] -= filter_coeffs[i] * out[n-i]; 103 out[n] -= filter_coeffs[i-1] * out[n-i];
106 } 104 }
107 } 105 }