[vlc-commits] transcode: audio: fix global-buffer-overflow

[Thomas Guillem]

vlc/vlc-3.0 | branch: master | Thomas Guillem <thomas at gllm.fr> | Tue Jan 30 18:44:30 2018 +0100| [ae1452927b4d767f153ea2c7479b95649a2ef8dd] | committer: Thomas Guillem

transcode: audio: fix global-buffer-overflow

(cherry picked from commit e426b400b9e03b136e5b00caba024a6a849a3975)
Signed-off-by: Thomas Guillem <thomas at gllm.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=ae1452927b4d767f153ea2c7479b95649a2ef8dd
---

 modules/stream_out/transcode/audio.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/modules/stream_out/transcode/audio.c b/modules/stream_out/transcode/audio.c
index f6d436bff3..d2c9f5f40a 100644
--- a/modules/stream_out/transcode/audio.c
+++ b/modules/stream_out/transcode/audio.c
@@ -109,6 +109,8 @@ static int transcode_audio_initialize_encoder( sout_stream_id_sys_t *id, sout_st
     id->p_encoder->fmt_out.audio.i_channels = p_sys->i_channels > 0 ?
         p_sys->i_channels : id->audio_dec_out.i_channels;
     assert(id->p_encoder->fmt_out.audio.i_channels > 0);
+    if( id->p_encoder->fmt_out.audio.i_channels >= ARRAY_SIZE(pi_channels_maps) )
+        id->p_encoder->fmt_out.audio.i_channels = ARRAY_SIZE(pi_channels_maps) - 1;
 
     id->p_encoder->fmt_in.audio.i_physical_channels =
     id->p_encoder->fmt_out.audio.i_physical_channels =
@@ -421,6 +423,9 @@ bool transcode_audio_add( sout_stream_t *p_stream, const es_format_t *p_fmt,
     id->p_encoder->fmt_out.audio.i_channels = p_sys->i_channels > 0 ?
         p_sys->i_channels : p_fmt->audio.i_channels;
 
+    if( id->p_encoder->fmt_out.audio.i_channels >= ARRAY_SIZE(pi_channels_maps) )
+        id->p_encoder->fmt_out.audio.i_channels = ARRAY_SIZE(pi_channels_maps) - 1;
+
     id->p_encoder->fmt_in.audio.i_physical_channels =
     id->p_encoder->fmt_out.audio.i_physical_channels =
             pi_channels_maps[id->p_encoder->fmt_out.audio.i_channels];