[FFmpeg-cvslog] adpcm: Avoid reading out of bounds in the IMA QT trellis encoder

[Martin Storsjö]

ffmpeg | branch: release/2.2 | Martin Storsjö <martin at martin.st> | Thu Jun  5 11:48:53 2014 +0300| [771564945aa9aebe2f30192b925fcf4909225eca] | committer: Luca Barbato

adpcm: Avoid reading out of bounds in the IMA QT trellis encoder

This was broken in 095be4fb - samples+ch (for the previous
non-planar case) equals &samples_p[ch][0]. The confusion
probably stemmed from the IMA WAV case where it originally
was &samples[avctx->channels + ch], which was correctly
changed into &samples_p[ch][1].

CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>
(cherry picked from commit 3d79d0c93e5b37a35b1b22d6c18699c233aad1ba)
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=771564945aa9aebe2f30192b925fcf4909225eca
---

 libavcodec/adpcmenc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/adpcmenc.c b/libavcodec/adpcmenc.c
index fb3ce0d..2cf8d6f 100644
--- a/libavcodec/adpcmenc.c
+++ b/libavcodec/adpcmenc.c
@@ -549,7 +549,7 @@ static int adpcm_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
             put_bits(&pb, 7,  status->step_index);
             if (avctx->trellis > 0) {
                 uint8_t buf[64];
-                adpcm_compress_trellis(avctx, &samples_p[ch][1], buf, status,
+                adpcm_compress_trellis(avctx, &samples_p[ch][0], buf, status,
                                        64, 1);
                 for (i = 0; i < 64; i++)
                     put_bits(&pb, 4, buf[i ^ 1]);