mpegtsenc: Fix off-by-one in indexing into Opus channel mapping arrays

Fixes, CID1338323, CID1338324 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
9 years ago · eb3628d87f
parent 77a644e6fa
commit eb3628d87f
1 changed files with 2 additions and 2 deletions
--- a/libavformat/mpegtsenc.c
+++ b/libavformat/mpegtsenc.c
@ -401,11 +401,11 @@ static int mpegts_write_pmt(AVFormatContext *s, MpegTSService *service)

                        if (st->codec->extradata[19] == st->codec->channels - coupled_stream_counts[st->codec->channels] &&
                            st->codec->extradata[20] == coupled_stream_counts[st->codec->channels] &&
-                            memcmp(&st->codec->extradata[21], channel_map_a[st->codec->channels], st->codec->channels) == 0) {
+                            memcmp(&st->codec->extradata[21], channel_map_a[st->codec->channels-1], st->codec->channels) == 0) {
                            *q++ = st->codec->channels;
                        } else if (st->codec->channels >= 2 && st->codec->extradata[19] == st->codec->channels &&
                                   st->codec->extradata[20] == 0 &&
-                                   memcmp(&st->codec->extradata[21], channel_map_b[st->codec->channels], st->codec->channels) == 0) {
+                                   memcmp(&st->codec->extradata[21], channel_map_b[st->codec->channels-1], st->codec->channels) == 0) {
                            *q++ = st->codec->channels | 0x80;
                        } else {
                            /* Unsupported, could write an extended descriptor here */