From eb3628d87f67b35e8dd354a466028e93bdd7f9c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Thu, 3 Dec 2015 23:04:09 +0200 Subject: [PATCH] mpegtsenc: Fix off-by-one in indexing into Opus channel mapping arrays Fixes, CID1338323, CID1338324 Signed-off-by: Michael Niedermayer --- libavformat/mpegtsenc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavformat/mpegtsenc.c b/libavformat/mpegtsenc.c index 8591e8cde6..27cd89f403 100644 --- a/libavformat/mpegtsenc.c +++ b/libavformat/mpegtsenc.c @@ -401,11 +401,11 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service) if (st->codec->extradata[19] == st->codec->channels - coupled_stream_counts[st->codec->channels] && st->codec->extradata[20] == coupled_stream_counts[st->codec->channels] && - memcmp(&st->codec->extradata[21], channel_map_a[st->codec->channels], st->codec->channels) == 0) { + memcmp(&st->codec->extradata[21], channel_map_a[st->codec->channels-1], st->codec->channels) == 0) { *q++ = st->codec->channels; } else if (st->codec->channels >= 2 && st->codec->extradata[19] == st->codec->channels && st->codec->extradata[20] == 0 && - memcmp(&st->codec->extradata[21], channel_map_b[st->codec->channels], st->codec->channels) == 0) { + memcmp(&st->codec->extradata[21], channel_map_b[st->codec->channels-1], st->codec->channels) == 0) { *q++ = st->codec->channels | 0x80; } else { /* Unsupported, could write an extended descriptor here */