From e2935721e00a6eb60fadb0839d3e24591a33a359 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 4 Oct 2012 22:54:29 +0200 Subject: [PATCH] aacenc: fix out of array writes The value used in allocation is based on a estimate of the maximum size of the spectral coefficients multiplied with 2 and rounded up. The exact or a tighter limit should be found and used instead. But this issue shouldnt be left open until someone works on that. Signed-off-by: Michael Niedermayer (cherry picked from commit d56834201bf7511ed497e956fb7ff78d49454b10) Signed-off-by: Michael Niedermayer --- libavcodec/aacenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/aacenc.c b/libavcodec/aacenc.c index 9b2b2bbab5..383cb5a7c1 100644 --- a/libavcodec/aacenc.c +++ b/libavcodec/aacenc.c @@ -576,7 +576,7 @@ static int aac_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, } start_ch += chans; } - if ((ret = ff_alloc_packet2(avctx, avpkt, 768 * s->channels))) { + if ((ret = ff_alloc_packet2(avctx, avpkt, 8192 * s->channels))) { av_log(avctx, AV_LOG_ERROR, "Error getting output packet\n"); return ret; }