src/src_sinc.c : Fix a read beyond end of coefficent array problem.

ChangeLog

@@ -1,3 +1,14 @@
+2013-03-29  Erik de Castro Lopo  <erikd AT mega-nerd DOT com>
+
+    * src/src_sinc.c
+    Fix a read beyond end of coefficent array problem uncovered by gcc-4.8's
+    -fsanitize=address feature and reported by Cristian Rodríguez.
+
+    Since this is reading filter coefficients from rodata memory and no write
+    is possible, is is not exploitable from a security point of view.
+
+    Solution was to reduce the half_coeff_len value for each filter by one.
+
 2013-01-16  Erik de Castro Lopo  <erikd AT mega-nerd DOT com>
 
     * src/samplerate.h src/common.h

src/src_sinc.c

@@ -1,5 +1,5 @@
 /*
-** Copyright (C) 2002-2012 Erik de Castro Lopo <erikd@mega-nerd.com>
+** Copyright (C) 2002-2013 Erik de Castro Lopo <erikd@mega-nerd.com>
 **
 ** This program is free software; you can redistribute it and/or modify
 ** it under the terms of the GNU General Public License as published by
@@ -201,19 +201,19 @@ sinc_set_converter (SRC_PRIVATE *psrc, int src_enum)
 	switch (src_enum)
 	{	case SRC_SINC_FASTEST :
 				temp_filter.coeffs = fastest_coeffs.coeffs ;
-				temp_filter.coeff_half_len = ARRAY_LEN (fastest_coeffs.coeffs) - 1 ;
+				temp_filter.coeff_half_len = ARRAY_LEN (fastest_coeffs.coeffs) - 2 ;
 				temp_filter.index_inc = fastest_coeffs.increment ;
 				break ;
 
 		case SRC_SINC_MEDIUM_QUALITY :
 				temp_filter.coeffs = slow_mid_qual_coeffs.coeffs ;
-				temp_filter.coeff_half_len = ARRAY_LEN (slow_mid_qual_coeffs.coeffs) - 1 ;
+				temp_filter.coeff_half_len = ARRAY_LEN (slow_mid_qual_coeffs.coeffs) - 2 ;
 				temp_filter.index_inc = slow_mid_qual_coeffs.increment ;
 				break ;
 
 		case SRC_SINC_BEST_QUALITY :
 				temp_filter.coeffs = slow_high_qual_coeffs.coeffs ;
-				temp_filter.coeff_half_len = ARRAY_LEN (slow_high_qual_coeffs.coeffs) - 1 ;
+				temp_filter.coeff_half_len = ARRAY_LEN (slow_high_qual_coeffs.coeffs) - 2 ;
 				temp_filter.index_inc = slow_high_qual_coeffs.increment ;
 				break ;