[FFmpeg-cvslog] g723_1dec: Fix lsp2lpc() so it can handle values at the ends of the table.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Nov 16 21:25:40 2012 +0100| [6535d81d8788a6eb758dd08330d4915c224fa5ee] | committer: Michael Niedermayer

g723_1dec: Fix lsp2lpc() so it can handle values at the ends of the table.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=6535d81d8788a6eb758dd08330d4915c224fa5ee
---

 libavcodec/g723_1.c      |    2 +-
 libavcodec/g723_1_data.h |    3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavcodec/g723_1.c b/libavcodec/g723_1.c
index 58df03c..fd6b558 100644
--- a/libavcodec/g723_1.c
+++ b/libavcodec/g723_1.c
@@ -359,7 +359,7 @@ static void lsp2lpc(int16_t *lpc)
 
     /* Calculate negative cosine */
     for (j = 0; j < LPC_ORDER; j++) {
-        int index     = lpc[j] >> 7;
+        int index     = (lpc[j] >> 7) & 0x1FF;
         int offset    = lpc[j] & 0x7f;
         int temp1     = cos_tab[index] << 16;
         int temp2     = (cos_tab[index + 1] - cos_tab[index]) *
diff --git a/libavcodec/g723_1_data.h b/libavcodec/g723_1_data.h
index 8ee4a91..38a6c59 100644
--- a/libavcodec/g723_1_data.h
+++ b/libavcodec/g723_1_data.h
@@ -128,7 +128,7 @@ static const int16_t dc_lsp[LPC_ORDER] = {
 /**
  * Cosine table scaled by 2^14
  */
-static const int16_t cos_tab[COS_TBL_SIZE] = {
+static const int16_t cos_tab[COS_TBL_SIZE+1] = {
     16384,  16383,  16379,  16373,  16364,  16353,  16340,  16324,
     16305,  16284,  16261,  16235,  16207,  16176,  16143,  16107,
     16069,  16029,  15986,  15941,  15893,  15843,  15791,  15736,
@@ -193,6 +193,7 @@ static const int16_t cos_tab[COS_TBL_SIZE] = {
     15679,  15736,  15791,  15843,  15893,  15941,  15986,  16029,
     16069,  16107,  16143,  16176,  16207,  16235,  16261,  16284,
     16305,  16324,  16340,  16353,  16364,  16373,  16379,  16383,
+    16384
 };
 
 /**