From 66f7e4fe0cadc630e1d4d2304713afe0d2066cc6 Mon Sep 17 00:00:00 2001 From: npwoods Date: Sun, 3 Nov 2019 15:25:04 -0500 Subject: Fix invalid std::vector<> lookup in aviio.cpp This fixes a case where: * m_soundbuf_samples == processedsamples * processedsamples > 0 * processedsamples * stream->channels() == m_soundbuf.size() In this scenario, the std::memmove() would do nothing (moving zero bytes), but the operator[] on the second parameter to std::memmove() overflows the array. This can be benign in optimized builds (because the third parameter to std::memmove() is 0), but on debugging builds this can cause an assert. --- src/lib/util/aviio.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/lib') diff --git a/src/lib/util/aviio.cpp b/src/lib/util/aviio.cpp index 771befa9ef5..c66f706b6e2 100644 --- a/src/lib/util/aviio.cpp +++ b/src/lib/util/aviio.cpp @@ -3550,7 +3550,8 @@ avi_file::error avi_file_impl::soundbuf_flush(bool only_flush_full) if (processedsamples > 0) { /* first account for the samples we processed */ - std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample); + if (m_soundbuf_samples > processedsamples) + std::memmove(&m_soundbuf[0], &m_soundbuf[processedsamples * stream->channels()], (m_soundbuf_samples - processedsamples) * bytes_per_sample); for (int channel = 0; channel < stream->channels(); channel++) m_soundbuf_chansamples[channel] -= processedsamples; } -- cgit v1.2.3