From 4671fb7dfb8e72b228e04f3b81da7f2003c62240 Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Mon, 27 Nov 2023 00:38:56 +0100
Subject: [PATCH] avfilter/af_dialoguenhance: simplify channels copy
References: https://bugzilla.opensuse.org/1222730
References: CVE-2023-49528

---
 libavfilter/af_dialoguenhance.c | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/libavfilter/af_dialoguenhance.c b/libavfilter/af_dialoguenhance.c
index 29c8ab10a7..5c8614c185 100644
--- a/libavfilter/af_dialoguenhance.c
+++ b/libavfilter/af_dialoguenhance.c
@@ -249,20 +249,21 @@ static int de_stereo(AVFilterContext *ctx, AVFrame *out)
     float *left_osamples   = (float *)out->extended_data[0];
     float *right_osamples  = (float *)out->extended_data[1];
     float *center_osamples = (float *)out->extended_data[2];
-    const int offset = s->fft_size - s->overlap;
-    const int nb_samples = FFMIN(s->overlap, s->in->nb_samples);
+    const int overlap = s->overlap;
+    const int offset = s->fft_size - overlap;
+    const int nb_samples = FFMIN(overlap, s->in->nb_samples);
     float vad;
 
     // shift in/out buffers
-    memmove(left_in, &left_in[s->overlap], offset * sizeof(float));
-    memmove(right_in, &right_in[s->overlap], offset * sizeof(float));
-    memmove(left_out, &left_out[s->overlap], offset * sizeof(float));
-    memmove(right_out, &right_out[s->overlap], offset * sizeof(float));
+    memmove(left_in, &left_in[overlap], offset * sizeof(float));
+    memmove(right_in, &right_in[overlap], offset * sizeof(float));
+    memmove(left_out, &left_out[overlap], offset * sizeof(float));
+    memmove(right_out, &right_out[overlap], offset * sizeof(float));
 
     memcpy(&left_in[offset], left_samples, nb_samples * sizeof(float));
     memcpy(&right_in[offset], right_samples, nb_samples * sizeof(float));
-    memset(&left_out[offset], 0, s->overlap * sizeof(float));
-    memset(&right_out[offset], 0, s->overlap * sizeof(float));
+    memset(&left_out[offset], 0, overlap * sizeof(float));
+    memset(&right_out[offset], 0, overlap * sizeof(float));
 
     apply_window(s, left_in,  windowed_left,  0);
     apply_window(s, right_in, windowed_right, 0);
@@ -292,14 +293,15 @@ static int de_stereo(AVFilterContext *ctx, AVFrame *out)
 
     apply_window(s, windowed_oleft, left_out,  1);
 
-    for (int i = 0; i < s->overlap; i++) {
-        // 4 times overlap with squared hanning window results in 1.5 time increase in amplitude
-        if (!ctx->is_disabled)
+    memcpy(left_osamples, left_in, overlap * sizeof(float));
+    memcpy(right_osamples, right_in, overlap * sizeof(float));
+
+    // 4 times overlap with squared hanning window results in 1.5 time increase in amplitude
+    if (!ctx->is_disabled) {
+        for (int i = 0; i < overlap; i++)
             center_osamples[i] = left_out[i] / 1.5f;
-        else
-            center_osamples[i] = 0.f;
-        left_osamples[i]  = left_in[i];
-        right_osamples[i] = right_in[i];
+    } else {
+        memset(center_osamples, 0, overlap * sizeof(float));
     }
 
     return 0;
-- 
2.44.0

