diff options
| author | Jean-Marc Valin <jmvalin@jmvalin.ca> | 2016-07-24 22:37:27 +0300 |
|---|---|---|
| committer | Jean-Marc Valin <jmvalin@jmvalin.ca> | 2016-07-24 22:37:27 +0300 |
| commit | 2d3ff4239cb7f2c63bb20714f61f69c3635e6fdc (patch) | |
| tree | 1d23e147635ba4049305fb3e1c8f4513b58bc4ea | |
| parent | cbceaa8579e16c0690e6f6469c459d889b0a3e36 (diff) | |
Avoids reading beyond the current buffer in comb_filter()
This could cause overflows when processing non-saturated TDAC values.
| -rw-r--r-- | celt/celt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/celt/celt.c b/celt/celt.c index f332191c..747e724a 100644 --- a/celt/celt.c +++ b/celt/celt.c @@ -207,6 +207,10 @@ void comb_filter(opus_val32 *y, opus_val32 *x, int T0, int T1, int N, OPUS_MOVE(y, x, N); return; } + /* When the gain is zero, T0 and/or T1 is set to zero. We need + to have then be at least 2 to avoid processing garbage data. */ + T0 = IMAX(T0, 8); + T1 = IMAX(T1, 8); g00 = MULT16_16_P15(g0, gains[tapset0][0]); g01 = MULT16_16_P15(g0, gains[tapset0][1]); g02 = MULT16_16_P15(g0, gains[tapset0][2]); |