Fix a stack smashing bug

Roman Shterenzon · tmatth · commit f9e43a12f4a1 · 2019-01-24T17:17:54.000-05:00
Signed-off-by: Tristan Matthews &lt;tmatth@videolan.org&gt;
diff --git a/libspeexdsp/buffer.c b/libspeexdsp/buffer.c
@@ -135,7 +135,7 @@ EXPORT int speex_buffer_read(SpeexBuffer *st, void *_data, int len)
    char *data = _data;
    if (len > st->available)
    {
-      SPEEX_MEMSET(data+st->available, 0, st->size-st->available);
+      SPEEX_MEMSET(data+st->available, 0, len - st->available);
       len = st->available;
    }
    end = st->read_ptr + len;

Original file line number	Diff line number	Diff line change
`@@ -135,7 +135,7 @@ EXPORT int speex_buffer_read(SpeexBuffer st, void _data, int len)`
`135`	`135`	`char *data = _data;`
`136`	`136`	`if (len > st->available)`
`137`	`137`	`{`
`138`		`- SPEEX_MEMSET(data+st->available, 0, st->size-st->available);`
	`138`	`+ SPEEX_MEMSET(data+st->available, 0, len - st->available);`
`139`	`139`	`len = st->available;`
`140`	`140`	`}`
`141`	`141`	`end = st->read_ptr + len;`