diff options
author | Tim-Philipp Müller <tim@centricular.com> | 2015-09-26 09:23:05 +0100 |
---|---|---|
committer | Tim-Philipp Müller <tim@centricular.com> | 2015-09-26 09:24:25 +0100 |
commit | d57b0971987598c73ce96c9026d422c94712caae (patch) | |
tree | 40147034809210d2b4b5bc835ac36b9e2661da68 /gst | |
parent | d7f78391b4490b896df2f06d7c73676a7fc616f6 (diff) |
dvdlpcmdec: fix invalid read beyond channel position array
We would always copy sizeof(sorted_position) bytes, which is
for 8 channels, but if we have less than 8 channels the
position array we copy from will only have allocated space
for channel channels, so we would read beyond the input
array in some cases.
Diffstat (limited to 'gst')
-rw-r--r-- | gst/dvdlpcmdec/gstdvdlpcmdec.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/gst/dvdlpcmdec/gstdvdlpcmdec.c b/gst/dvdlpcmdec/gstdvdlpcmdec.c index b7b6039b27..69c395f6b5 100644 --- a/gst/dvdlpcmdec/gstdvdlpcmdec.c +++ b/gst/dvdlpcmdec/gstdvdlpcmdec.c @@ -250,10 +250,12 @@ gst_dvdlpcmdec_update_audio_formats (GstDvdLpcmDec * dec, gint channels, GST_AUDIO_CHANNEL_POSITION_INVALID) { const GstAudioChannelPosition *position; GstAudioChannelPosition sorted_position[8]; + guint c; position = channel_positions[channels - 1]; dec->lpcm_layout = position; - memcpy (sorted_position, position, sizeof (sorted_position)); + for (c = 0; c < channels; ++c) + sorted_position[c] = position[c]; gst_audio_channel_positions_to_valid_order (sorted_position, channels); gst_audio_info_set_format (&dec->info, format, rate, channels, sorted_position); |