Fixes: Ticket5297 Needs review by maintainer / author to check that this is ok and sufficient --- libavcodec/alsdec.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/libavcodec/alsdec.c b/libavcodec/alsdec.c index a7e58a2..9410f52 100644 --- a/libavcodec/alsdec.c +++ b/libavcodec/alsdec.c @@ -694,7 +694,7 @@ static int read_var_block_data(ALSDecContext *ctx, ALSBlockData *bd) } else { *bd->opt_order = sconf->max_order; } - if (*bd->opt_order > bd->block_length) { + if (*bd->opt_order > bd->block_length + sconf->max_order) { *bd->opt_order = bd->block_length; av_log(avctx, AV_LOG_ERROR, "Predictor order too large.\n"); return AVERROR_INVALIDDATA; @@ -1252,7 +1252,7 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd, ALSChannelData *ch = cd[c]; unsigned int dep = 0; unsigned int channels = ctx->avctx->channels; - unsigned int channel_size = ctx->sconf.frame_length + ctx->sconf.max_order; + unsigned int channel_size = ctx->sconf.frame_length + 2*ctx->sconf.max_order; if (reverted[c]) return 0; @@ -1311,7 +1311,7 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd, } if (FFMIN(begin - 1, begin - 1 + t) < ctx->raw_buffer - master || - FFMAX(end + 1, end + 1 + t) > ctx->raw_buffer + channels * channel_size - master) { + FFMAX(end + 1, end + 1 + t) > ctx->raw_buffer + channels * channel_size - master - ctx->sconf.max_order) { av_log(ctx->avctx, AV_LOG_ERROR, "sample pointer range [%p, %p] not contained in raw_buffer [%p, %p].\n", master + FFMIN(begin - 1, begin - 1 + t), master + FFMAX(end + 1, end + 1 + t), @@ -1333,7 +1333,7 @@ static int revert_channel_correlation(ALSDecContext *ctx, ALSBlockData *bd, } else { if (begin - 1 < ctx->raw_buffer - master || - end + 1 > ctx->raw_buffer + channels * channel_size - master) { + end + 1 > ctx->raw_buffer + channels * channel_size - master - ctx->sconf.max_order) { av_log(ctx->avctx, AV_LOG_ERROR, "sample pointer range [%p, %p] not contained in raw_buffer [%p, %p].\n", master + begin - 1, master + end + 1, @@ -1797,7 +1797,7 @@ static av_cold int decode_init(AVCodecContext *avctx) ctx->reverted_channels = NULL; } - channel_size = sconf->frame_length + sconf->max_order; + channel_size = sconf->frame_length + 2*sconf->max_order; ctx->prev_raw_samples = av_malloc_array(sconf->max_order, sizeof(*ctx->prev_raw_samples)); ctx->raw_buffer = av_mallocz_array(avctx->channels * channel_size, sizeof(*ctx->raw_buffer)); -- 1.7.9.5