libopusdec: fix out-of-bounds read

[ffmpeg] / libavcodec / hpeldsp.h

diff --git a/libavcodec/hpeldsp.h b/libavcodec/hpeldsp.h
index 7ffed1a604491b999ef47f535f0c71a77b1a3bd3..62dee6813de5c632a2440a39f58f5b147ac76d5c 100644 (file)
--- a/libavcodec/hpeldsp.h
+++ b/libavcodec/hpeldsp.h
@@ -69,15 +69,17 @@ typedef struct HpelDSPContext {
 
     /**
      * Halfpel motion compensation with no rounding (a+b)>>1.
-     * this is an array[2][4] of motion compensation functions for 2
+     * this is an array[4][4] of motion compensation functions for 2
      * horizontal blocksizes (8,16) and the 4 halfpel positions<br>
      * *pixels_tab[ 0->16xH 1->8xH ][ xhalfpel + 2*yhalfpel ]
      * @param block destination where the result is stored
      * @param pixels source
      * @param line_size number of bytes in a horizontal line of block
      * @param h height
+     * @note The size is kept at [4][4] to match the above pixel_tabs and avoid
+     *       out of bounds reads in the motion estimation code.
      */
-    op_pixels_func put_no_rnd_pixels_tab[2][4];
+    op_pixels_func put_no_rnd_pixels_tab[4][4];
 
     /**
      * Halfpel motion compensation with no rounding (a+b)>>1.