diff options
author | 2019-11-03 15:25:04 -0500 | |
---|---|---|
committer | 2019-11-04 13:32:22 +1100 | |
commit | 66f7e4fe0cadc630e1d4d2304713afe0d2066cc6 (patch) | |
tree | ba8ad5f56c54dcce1a87c320aabf190e02a8a063 | |
parent | e896b3914ecb262b5ec143b3918404d9866fa555 (diff) |
Fix invalid std::vector<> lookup in aviio.cpp
This fixes a case where:
* m_soundbuf_samples == processedsamples
* processedsamples > 0
* processedsamples * stream->channels() == m_soundbuf.size()
In this scenario, the std::memmove() would do nothing (moving zero
bytes), but the operator[] on the second parameter to std::memmove()
overflows the array. This can be benign in optimized builds (because
the third parameter to std::memmove() is 0), but on debugging builds
this can cause an assert.
-rw-r--r-- | src/lib/util/aviio.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/lib/util/aviio.cpp b/src/lib/util/aviio.cpp index 771befa9ef5..c66f706b6e2 100644 --- a/src/lib/util/aviio.cpp +++ b/src/lib/util/aviio.cpp @@ -3550,7 +3550,8 @@ avi_file::error avi_file_impl::soundbuf_flush(bool only_flush_full) if (processedsamples > 0) { /* first account for the samples we processed */ - std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample); + if (m_soundbuf_samples > processedsamples) + std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample); for (int channel = 0; channel < stream->channels(); channel++) m_soundbuf_chansamples[channel] -= processedsamples; } |