Fix a buffer overflow in op_read_stereo().
authorTimothy B. Terriberry <tterribe@xiph.org>
Mon, 25 Mar 2013 18:57:38 +0000 (11:57 -0700)
committerTimothy B. Terriberry <tterribe@xiph.org>
Mon, 25 Mar 2013 18:57:38 +0000 (11:57 -0700)
For multichannel files, this potentially caused writes beyond the
 end of the output buffer provided by the user.

src/opusfile.c

index 84bec44..f011c2e 100644 (file)
@@ -3052,7 +3052,7 @@ static int op_float2short_stereo_filter(OggOpusFile *_of,
       _nsamples=op_stereo_filter(_of,_src,_nsamples*2,
        _src,_nsamples,_nchannels);
     }
-    op_shaped_dither16(_of,dst,_src,_nsamples,_nchannels);
+    op_shaped_dither16(_of,dst,_src,_nsamples,2);
   }
   return _nsamples;
 }