sonic: make sure num_taps * channels is not larger than frame_size
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Tue, 15 Dec 2015 22:43:03 +0000 (23:43 +0100)
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Thu, 17 Dec 2015 18:55:09 +0000 (19:55 +0100)
commit9637c2531f7eb040ad1c3cb46cb40a63dfc77b80
tree2d7523769f8878c2a898e36356a7a85d4bcfd0e7
parentc67cf84d7c65fc4894db3133cabbbe0ac0aa1cb0
sonic: make sure num_taps * channels is not larger than frame_size

If that is the case, the loop setting predictor_state in
sonic_decode_frame causes out of bounds reads of int_samples, which has
only frame_size number of elements.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavcodec/sonic.c