[FFmpeg-cvslog] g723_1: Handle values at the ends of the table in lsp2lpc()

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Mon Nov 23 17:10:51 2015 -0500| [b74b88f30da2389f333a31815d8326d5576d3331] | committer: Vittorio Giovara

g723_1: Handle values at the ends of the table in lsp2lpc()

Fixes out of array reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
Signed-off-by: Vittorio Giovara <vittorio.giovara at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b74b88f30da2389f333a31815d8326d5576d3331
---

 libavcodec/g723_1.c      |    2 +-
 libavcodec/g723_1_data.h |    3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/g723_1.c b/libavcodec/g723_1.c
index 4904e52..80c7d1f 100644
--- a/libavcodec/g723_1.c
+++ b/libavcodec/g723_1.c
@@ -386,7 +386,7 @@ static void lsp2lpc(int16_t *lpc)
 
     /* Calculate negative cosine */
     for (j = 0; j < LPC_ORDER; j++) {
-        int index     = lpc[j] >> 7;
+        int index     = (lpc[j] >> 7) & 0x1FF;
         int offset    = lpc[j] & 0x7f;
         int temp1     = cos_tab[index] << 16;
         int temp2     = (cos_tab[index + 1] - cos_tab[index]) *
diff --git a/libavcodec/g723_1_data.h b/libavcodec/g723_1_data.h
index 04f8a06..c4c4d77 100644
--- a/libavcodec/g723_1_data.h
+++ b/libavcodec/g723_1_data.h
@@ -56,7 +56,7 @@ static const int16_t dc_lsp[LPC_ORDER] = {
 };
 
 /* Cosine table scaled by 2^14 */
-static const int16_t cos_tab[COS_TBL_SIZE] = {
+static const int16_t cos_tab[COS_TBL_SIZE + 1] = {
     16384,  16383,  16379,  16373,  16364,  16353,  16340,  16324,
     16305,  16284,  16261,  16235,  16207,  16176,  16143,  16107,
     16069,  16029,  15986,  15941,  15893,  15843,  15791,  15736,
@@ -121,6 +121,7 @@ static const int16_t cos_tab[COS_TBL_SIZE] = {
     15679,  15736,  15791,  15843,  15893,  15941,  15986,  16029,
     16069,  16107,  16143,  16176,  16207,  16235,  16261,  16284,
     16305,  16324,  16340,  16353,  16364,  16373,  16379,  16383,
+    16384
 };
 
 /* LSP VQ tables */