Commit 4bf2e7c5 authored by Mans Rullgard's avatar Mans Rullgard

twinvq: fix out of bounds array access

ModeTab.fmode has only 3 elements, so indexing it with ftype
in the initialier for 'size' is invalid when ftype == FT_PPC.

This fixes crashes with gcc 4.8.
Signed-off-by: 's avatarMans Rullgard <mans@mansr.com>
parent 4010d724
......@@ -1000,14 +1000,16 @@ static av_cold void construct_perm_table(TwinContext *tctx,enum FrameType ftype)
{
int block_size;
const ModeTab *mtab = tctx->mtab;
int size = tctx->avctx->channels*mtab->fmode[ftype].sub;
int size;
int16_t *tmp_perm = (int16_t *) tctx->tmp_buf;
if (ftype == FT_PPC) {
size = tctx->avctx->channels;
block_size = mtab->ppc_shape_len;
} else
} else {
size = tctx->avctx->channels * mtab->fmode[ftype].sub;
block_size = mtab->size / mtab->fmode[ftype].sub;
}
permutate_in_line(tmp_perm, tctx->n_div[ftype], size,
block_size, tctx->length[ftype],
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment