Merge 97214 - Heap buffer overflow in Webaudio FFTFrame::doFFT

Source/WebCore/platform/audio/HRTFPanner.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 46 matching lines @@
 }
 
 HRTFPanner::~HRTFPanner()
 {
 }
 
 size_t HRTFPanner::fftSizeForSampleRate(double sampleRate)
 {
     // The HRTF impulse responses (loaded as audio resources) are 512 sample-frames @44.1KHz.
     // Currently, we truncate the impulse responses to half this size, but an FFT-size of twice impulse response size is needed (for convolution).
-    // So for sample rates around 44.1KHz an FFT size of 512 is good.  We double that size for higher sample rates.
+    // So for sample rates around 44.1KHz an FFT size of 512 is good. We double the FFT-size only for sample rates at least double this.
     ASSERT(sampleRate >= 44100 && sampleRate <= 96000.0);
-    return (sampleRate <= 48000.0) ? 512 : 1024;
+    return (sampleRate < 88200.0) ? 512 : 1024;
 }
 
 void HRTFPanner::reset()
 {
     m_isFirstRender = true;
     m_convolverL.reset();
     m_convolverR.reset();
     m_delayLineL.reset();
     m_delayLineR.reset();
 }
@@ skipping 140 matching lines @@
 
         // Now do the convolutions in-place.
         m_convolverL.process(kernelL->fftFrame(), segmentDestinationL, segmentDestinationL, framesPerSegment);
         m_convolverR.process(kernelR->fftFrame(), segmentDestinationR, segmentDestinationR, framesPerSegment);
     }
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(WEB_AUDIO)