From b143844ea0f6246e0d5a938d743e2e8a98453bec Mon Sep 17 00:00:00 2001 From: Alex Converse Date: Tue, 11 Dec 2012 17:26:10 -0800 Subject: [PATCH] aacdec: Fix an off-by-one overwrite when switching to LTP profile from MAIN. Found-by: pawlkt CC: libav-stable@libav.org Fixes: CVE-2012-5144 (cherry picked from commit 6d5b0092678b2a95dfe209a207550bd2fe9ef646) Signed-off-by: Reinhard Tartler --- libavcodec/aacdec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aacdec.c b/libavcodec/aacdec.c index cf7b43d53f..d479c947a9 100644 --- a/libavcodec/aacdec.c +++ b/libavcodec/aacdec.c @@ -1692,7 +1692,7 @@ static void apply_tns(float coef[1024], TemporalNoiseShaping *tns, int w, filt, m, i; int bottom, top, order, start, end, size, inc; float lpc[TNS_MAX_ORDER]; - float tmp[TNS_MAX_ORDER]; + float tmp[TNS_MAX_ORDER + 1]; for (w = 0; w < ics->num_windows; w++) { bottom = ics->num_swb;