[FFmpeg-devel] [PATCH 1/4] avfilter/af_alimiter: Check nextpos before use

[Michael Niedermayer]

Fixes: out of array read
Fixes: tickets/10744/poc11ffmpeg

Found-by: Li Zeyuan and Zeng Yunxiang.
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavfilter/af_alimiter.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libavfilter/af_alimiter.c b/libavfilter/af_alimiter.c
index f08893229de..9a867047643 100644
--- a/libavfilter/af_alimiter.c
+++ b/libavfilter/af_alimiter.c
@@ -195,9 +195,10 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
                     int j = i % buffer_size;
                     double ppeak = 0, pdelta;
 
-                    for (c = 0; c < channels; c++) {
-                        ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c]));
-                    }
+                    if (nextpos[j] >= 0)
+                        for (c = 0; c < channels; c++) {
+                            ppeak = FFMAX(ppeak, fabs(buffer[nextpos[j] + c]));
+                        }
                     pdelta = (limit / peak - limit / ppeak) / (((buffer_size - nextpos[j] + s->pos) % buffer_size) / channels);
                     if (pdelta < nextdelta[j]) {
                         nextdelta[j] = pdelta;
-- 
2.17.1