Commit f51fdfe4 authored by sagnowski's avatar sagnowski
Browse files

Fix out-of-bounds accesses

parent 62b34154

lib_dec/jbm_jb4_circularbuffer.c

+6 −3
Original line number Diff line number Diff line
@@ -438,6 +438,9 @@ static void JB4_CIRCULARBUFFER_calcPercentile( 
    JB4_CIRCULARBUFFER_ELEMENT newElement )

{

    uint16_t i;

#ifdef FIX_520_REMOVE_MEMMOVE_JBM

    uint16_t j;

#endif



    /* insert newElement if elements buffer is not yet full */

    if ( *size < capacity )
@@ -448,9 +451,9 @@ static void JB4_CIRCULARBUFFER_calcPercentile( 
            {

                /* insert newElement at index i */

#ifdef FIX_520_REMOVE_MEMMOVE_JBM

                for ( int16_t j = ( *size - i ); j >= 0; j-- )

                for ( j = *size; j > i; --j )

                {

                    elements[i + 1 + j] = elements[i + j];

                    elements[j] = elements[j - 1];

                }

#else

                memmove( elements + i + 1, elements + i, ( *size - i ) * sizeof( JB4_CIRCULARBUFFER_ELEMENT ) ); /* IVAS_fmToDo: avoid use of memmove() */
@@ -479,7 +482,7 @@ static void JB4_CIRCULARBUFFER_calcPercentile( 
        {

            /* insert newElement at index i */

#ifdef FIX_520_REMOVE_MEMMOVE_JBM

            for ( int16_t j = 0; j < i; j++ )

            for ( j = 0; j < i; j++ )

            {

                elements[j] = elements[1 + j];

            }

lib_dec/jbm_jb4_inputbuffer.c

+5 −2
Original line number Diff line number Diff line
@@ -151,6 +151,9 @@ int16_t JB4_INPUTBUFFER_Enque( 
    uint16_t canMoveRight;

    uint16_t canMoveLeft;

    bool replace;

#ifdef FIX_520_REMOVE_MEMMOVE_JBM

    uint16_t j;

#endif

    *replacedElement = NULL;



    size = JB4_INPUTBUFFER_Size( h );
@@ -237,9 +240,9 @@ int16_t JB4_INPUTBUFFER_Enque( 
    {

        /* move higher elements to the right and insert at insertPos */

#ifdef FIX_520_REMOVE_MEMMOVE_JBM

        for ( int16_t j = h->writePos - insertPos; j >= 0; j-- )

        for ( j = h->writePos; j > insertPos; --j )

        {

            h->data[insertPos + 1 + j] = h->data[insertPos + j];

            h->data[j] = h->data[j - 1];

        }

#else

        memmove( h->data + insertPos + 1, h->data + insertPos, ( h->writePos - insertPos ) * sizeof( JB4_INPUTBUFFER_ELEMENT ) ); /* IVAS_fmToDo: avoid use of memmove() */